Update the web server configuration to enable SSL

These instructions apply to Apache version 2.4.xx and the procedure must be executed on the designated Web server.

Copy the certificate files, typically generated via a certificate authority (CA), to a folder in the Web server's Apache configuration folder.
Note:
Configuration files shipped with IT Analytics licensed modules may use path names with recommended folder names. To use folders with different names, be sure to update all references to the recommended name in the default configuration files.
Linux
```
/opt/apache/conf/ssl_cert
```
Windows
```
C:\opt\apache\conf\ssl_cert
```

Stop the Apache and Tomcat services. From a terminal console, enter the following commands.

Linux

/opt/aptare/bin/tomcat-agent stop
/opt/aptare/bin/tomcat-portal stop
/opt/aptare/bin/apache stop

Windows

C:\opt\aptare\utils\stopagent.bat
C:\opt\aptare\utils\stopportal.bat
C:\opt\aptare\utils\stopapache.bat

Update the Apache configuration file to enable SSL.
Linux: /opt/apache/conf/httpd.conf
Windows: C:\opt\apache\conf\httpd.conf
Un-comment the following lines by removing the # character.
Linux
```
#LoadModule ssl_module modules/mod_ssl.so
#Include conf/extra/httpd-ssl.conf
```
Windows
```
#LoadModule ssl_module modules/mod_ssl.so
#Include conf/extra/httpd-ssl.conf
```
On an SSL enabled Portal server, it is recommended to either disable http or redirect http protocol to https.
- To disable http protocol, edit httpd.conf file and remove VirtualHost section of portal configuration
- To redirect http protocol to https, edit httpd.conf file, remove all entries of VirtualHost section of portal configuration and add following lines in same VirtualHost:
```
ServerName   itanalyticsportal.<hostname>
Redirect permanent / https://itanalyticsportal.<hostname>/
```
To ensure a secure web server, remove any port 80 VirtualHost sections from the /opt/apache/conf/httpd.conf file.
This prevents the HTTP message headers from getting unencrypted if one end of the communication is using non-HTTPS protocols.
If a Virtual Host declaration is missing from the default Apache SSL configuration file, add the missing virtual host declaration to the configuration file. See the relevant section for instructions.
For each active virtual host section in the Apache SSL configuration file (httpd-ssl.conf), ensure that declaration lines beginning with the following are un-commented (they do not have a # at the beginning of the line):
```
SSLEngine
SSLCertificateFile (update certificate file details)
SSLCertificateKeyFile (update certificate key file details)
```
Run the deployCert utility as root user on the Portal server to save the ssl certificates configured with Apache in java keystore itanalytics.jks .
This will be used while configuring SingleSignOn and Syslog over SSL.
- Linux: /opt/aptare/utils/deployCert.sh update
- Windows: C:\opt\aptare\utils>deployCert.bat update

Verify the Apache configuration is valid:, for Linux only

# export LD_LIBRARY_PATH=/opt/apache/ssl/lib:$LD_LIBRARY_PATH
(If https is enabled)

# /opt/apache/bin/apachectl -t

If SSL is enabled, change the applicationUrl in portal.properties to https instead of http.

Restart Apache and both Tomcat (Portal and Data Collector) services.

Linux

/opt/aptare/bin/apache start
/opt/aptare/bin/tomcat-portal start
/opt/aptare/bin/tomcat-agent start

Windows

C:\opt\aptare\utils\startapache.bat
C:\opt\aptare\utils\startagent.bat
C:\opt\aptare\utils\startportal.bat

Update the default CipherSuite provided in the Apache Httpd configuration

IT Analytics Portal supports only one CipherSuite ECDHE-RSA-AES256-GCM-SHA384 by default if configured with https.

To update the Apache httpd setting with a different value, follow the steps described below.

Stop Apache httpd and Tomcat services.

Linux

/opt/aptare/bin/tomcat-agent stop
/opt/aptare/bin/tomcat-portal stop
/opt/aptare/bin/apache stop

Windows

C:\opt\aptare\utils\stopagent.bat
C:\opt\aptare\utils\stopportal.bat
C:\opt\aptare\utils\stopapache.bat

Update the httpd-ssl-override.conf file with required values for SSLCipherSuite.
Linux: /opt/apache/conf/extra/httpd-ssl-override.conf
Windows: C:\opt\apache\conf\extra\httpd-ssl-override.conf
```
SSLCipherSuite <new list of Cipher Suites separated by colon>
```

Start Apache httpd and Tomcat services

Linux

/opt/aptare/bin/apache start
/opt/aptare/bin/tomcat-portal start
/opt/aptare/bin/tomcat-agent star

Windows

C:\opt\aptare\utils\startapache.bat
C:\opt\aptare\utils\startagent.bat
C:\opt\aptare\utils\startportal.bat

Update the web server configuration to enable SSL

Feedback

Feedback