Client-server encrypted communication
HTTPS communication between client software and the CLC Server is supported out of the box using a self-signed certificate. A description of how this is done is below.
Note: When upgrading in place from the CLC Genomics Server 24.x or earlier, client-server encrypted communication is not enabled out of the box. Instructions are provided later in this section for enabling client-server communication on such setups.
Logging in from a CLC Workbench is described in Logging in using SSL from the Workbench.
Connecting using the CLC Server Command Line Tools is described in Logging in using SSL from the CLC Server Command Line Tools.
The web client for an SSL-enabled CLC Server can be accessed using HTTPS and the relevant port, e.g. https://<hostname>:8443.
Client-server encrypted communication enabled out of the box using self-signed certificates
A new installation of the CLC Server supports HTTPS communication between clients and the server out of the box using a self-signed certificate that comes with the distribution. That certificate can be found at conf/clc-server-self-signed.p12, under the installation directory of the CLC Server. The Tomcat configuration file conf/server.xml contains a valid, SSL enabled Connector using this certificate, configured for port 8443.
Thus, after installing the CLC Server, client software can connect using port 8443 and communication via that connection will be encrypted.
Note however that the hostname (Common Name) in that self-signed certificate is, by default, "CLC Server". That is, it will not match the hostname of the server. A user of client software, for example, a CLC Workbench, can choose to trust the certificate despite this, but we recommend updating the certificate with a matching hostname. This is easily done using "Create a self-signed certificate" option in the HTTPS Configuration tool, which is launched by clicking on the HTTPS Configuration... button under Job processing | Server settings | SSL and certificate management.
Important notes:
- Connections between the CLC Server and client software can still be made using port 7777. Connections using that port are not encrypted by default.
- When upgrading the CLC Server in place from version 24.x or earlier, HTTPS communication between client and server is not enabled out of the box because the Tomcat configuration file,
conf/server.xml, is not overwritten when upgrading. To enable encrypted client-server communication using the self-signed certificate atconf/clc-server-self-signed.p12, add a relevant Connector to the Tomcat configuration file. This can be done easily using the HTTPS Configuration tool, which is launched by clicking on the HTTPS Configuration... button under Job processing | Server settings | SSL and certificate management. - Connector configuration syntax deprecated in Tomcat 9 is not recognized by the HTTPS Configuration tool. If you wish to update a certificate using functionality in that tool, first use the tool to edit the Tomcat configuration to update the Connector syntax to the expected form.
Configuring HTTPS communication between client and server when upgrading in place from version 24.x or earlier
When working on a system upgraded from version 24.x or earlier to 25.x or later, on a setup where encrypted communication is not already configured between client software and the CLC Server, carry out the following steps:
- If not already present, add a Connector that supports encrypted communication to the Tomcat configuration file,
conf/server.xml.To do this, click on the HTTPS Configuration... button and choose the option "Edit Tomcat configuration".
To easily add a new Connector of the expected form, click on the "Copy default SSL <Connector> configuration to clipboard" link near the top of the dialog and then paste the contents of the clipboard into the
server.xmlconfiguration file.If you are not using the self-signed certificate at
conf/clc-server-self-signed.p12, you can click on the Include keystore file... button to add an X.509 certificate into theconfdirectory of the CLC Server installation. - To use the self-signed certificate at
conf/clc-server-self-signed.p12, update it with the correct hostname for the system. To do this, click on the HTTPS Configuration... button and choose the option "Create self-signed certificate". Ensure the correct hostname is in the "Hostname for certificate (Common Name)" field before clicking on the Create Certificate... button.