Master-grid node encrypted communication
By default, communication from grid nodes to a master takes place over HTTP. For HTTPS communication, the following must be in place:
- SSL must be enabled on Tomcat, i.e.
- A certificate must be in place on the CLC Server master node.
- The Tomcat configuration file,
conf/server.xml, on the master node must include a Connector that supports encrypted communication. - The master's certificate must be trusted. If using a self-signed certificate it must be added to its own trust store. This is described further below.
- Update the port setting for the master to use a port that supports encrypted communication.
- The "Use HTTPS for node -> master communication" box in the Server settings area must be checked.
After updating this setting, the change must be saved by clicking on the Save Configuration button.
Working with self-signed certificates on master-grid node setups
When working with self-signed certificates, configure the master as follows:
- If not already present, add a Connector that supports encrypted communication to the Tomcat configuration file,
conf/server.xml.To do this, click on the HTTPS Configuration... button and choose the option "Edit Tomcat configuration".
To easily add a new Connector of the expected form, click on the "Copy default SSL <Connector> configuration to clipboard" link near the top of the dialog and then paste the contents of the clipboard into the
server.xmlconfiguration file.If you are not using the self-signed certificate at
conf/clc-server-self-signed.p12, you can click on the Include keystore file... button to add an X.509 certificate into theconfdirectory of the CLC Server installation. - To use the self-signed certificate at
conf/clc-server-self-signed.p12, update it with the correct hostname for the system. To do this, click on the HTTPS Configuration... button and choose the option "Create self-signed certificate". Ensure the correct hostname is in the "Hostname for certificate (Common Name)" field before clicking on the Create Certificate... button. - Restart the CLC Server when prompted to arrange for a restart.
- Update the port setting for the master to use a port that supports encrypted communication.
- Check the box beside "Use HTTPS for node -> master communication".
- Click on the Save Configuration button.
- Click on the Certificates... button in the "SSL and certificate management" section.
- Click on the Trust Master Node button.
This adds the master node's certificate to its own trust store.
Communication between the master and grid nodes will now be encrypted.