Master-job node encrypted communication

By default, communication between a master and job nodes takes place over HTTP using port 7777. For HTTPS communication, the following must be in place:

In several places an opportunity to check the status of connections is offered. The check is done using the settings present at that moment, which are not necessarily the saved settings. For example, if the value in a port field were updated from 7777 to 8443 and then the Check Connections button was clicked on, port 8443 would be used for the communication done in carrying out the connection check.

Working with self-signed certificates on master-job node setups

The general list of steps required when working with self-signed certificates is below. There are helper tools available in the CLC Server web administrative interface for easily carrying out these activities.

There are various routes one can take to set up encrypted communication between a master and job nodes when using self-signed certificates. One of these, done entirely via the web administrative interface of the master CLC Server is the following:

  1. Detach any job nodes that are already attached.
  2. Configure the master as follows:
    1. If not already present, add a Connector that supports encrypted communication to the Tomcat configuration file, conf/server.xml.

      To do this, click on the HTTPS Configuration... button and choose the option "Edit Tomcat configuration".

      To easily add a new Connector of the expected form, click on the "Copy default SSL <Connector> configuration to clipboard" link near the top of the dialog and then paste the contents of the clipboard into the server.xml configuration file.

      If you are not using the self-signed certificate at conf/clc-server-self-signed.p12, you can click on the Include keystore file... button to add an X.509 certificate into the conf directory of the CLC Server installation.

    2. To use the self-signed certificate at conf/clc-server-self-signed.p12, update it with the correct hostname for the system. To do this, click on the HTTPS Configuration... button and choose the option "Create self-signed certificate". Ensure the correct hostname is in the "Hostname for certificate (Common Name)" field before clicking on the Create Certificate... button.

    3. Restart the CLC Server when prompted to arrange for a restart.
    4. Update the port setting for the master to use a port that supports encrypted communication.
    5. Check the box beside "Use HTTPS for node -> master communication".
    6. Click on the Save Configuration button.

      If there are problems with the setup at this point, an error message with details will be displayed.

  3. Attach each job node, configuring each to support encrypted communication.

    1. Click on the Attach Node button in the "Job node settings" area.
    2. Enter the hostname into the "Host" field.
    3. Enter a port into the "Port" field that supports non-encrypted communication (usually 7777),

    4. If not already present, add a Connector that supports encrypted communication to the Tomcat configuration file, conf/server.xml.

      To do this, click on the HTTPS Configuration... button and choose the option "Edit Tomcat configuration".

      To easily add a new Connector of the expected form, click on the "Copy default SSL <Connector> configuration to clipboard" link near the top of the dialog and then paste the contents of the clipboard into the server.xml configuration file.

      If you are not using the self-signed certificate at conf/clc-server-self-signed.p12, you can click on the Include keystore file... button to add an X.509 certificate into the conf directory of the CLC Server installation.

    5. To use the self-signed certificate at conf/clc-server-self-signed.p12, update it with the correct hostname for the system. To do this, click on the HTTPS Configuration... button and choose the option "Create self-signed certificate". Ensure the correct hostname is in the "Hostname for certificate (Common Name)" field before clicking on the Create Certificate... button.

      You will be prompted to arrange a restart if you have updated the the Tomcat configuration file or updated certificates. You can choose not to restart and continue with attaching the job node, and restart after that point.

    6. Click on the Check Connection... button in the "Add new job node" dialog.

      This checks for any problems, including checking that the master node's certificate is in the job node's trust store. Click on the Add to trust store button if it is present in the dialog.

      At this point, the communication between the job node and the master will be partly encrypted (figure 3.9).

      Image configuring_jobnode_for_encrypted_partly
      Figure 3.9: The master is configured to accept encrypted communication from job nodes. A job node is being attached. It current accepts only nonencrypted traffic using port 7777, as indicated in the information returned when checking the connection between the job node and master.

      If you have multiple job nodes to attach, the steps above can be carried out for each one before proceeding further.

    7. Restart the master and its job nodes by selecting the Restart option in the Server Maintenance section under the Status and management area on the master server. This restarts the master and all attached job nodes (described in Status and management).

    Each attached job node is now ready to be configured to receive communication via HTTPS:

    1. Click on the Edit... button next to the job node in the "Execution node settings" area.
    2. Update the port setting to the port that supports encrypted communication (often this is 8443).
    3. Check the box beside "Use HTTPS for master -> node communication".

      As soon as this box is checked, any communication from the master to the node will be encrypted, including any checks on connection status. Thus, check this box only after the items above this are complete, i.e. when encrypted communication can be successfully undertaken.

    4. Click on the Check Connection... button in the "Add new job node" dialog.

      This checks for any problems, including checking that the job node's certificate is in the master's trust store. Click on the Add to trust store button if it is present in the dialog.

      The communication between the job node and the master should now be fully encrypted (figure 3.8).

    5. After dismissing the "Node intercommunication check" dialog, click on the Save button in the "Edit job node" dialog.

    After attaching all the job nodes, click on the Check Connections... button at the bottom of the "Job node settings" area (figure 3.11). The status color, green or red, indicates whether the connection could be established or not, respectively. Hover the mouse cursor over the colored dot to see further information. Information in the SSL column indicates the configuration: "YES" indicates that the setup is configured for encrypted communication in both directions between master and job node. "PARTLY" indicates it is configured to be encrypted in one direction, but not the other. "NO" indicates that the setup is not configured for encrypted communication in either direction. Click on the Check... button in the "Check all connections" dialog to see a diagram showing further details about the communication in each direction.

Image add_jobnode_cert_to_master_truststore
Figure 3.10: Click on the "Check Connections..." button when attaching a job node to see information on the status of the connection between the master and that job node. If the communication is not trusted, you can click on the "Add to Trust Store" button to add the certificate presented by the job node to the master node's trust store.

Image master_jobnode_https_configured_by_check
Figure 3.11: The connections between master and a single, attached job node has been checked. Communication can be achieved in both directions, as indicated by the status (green dot), and the communication in both directions is encrypted (HTTPS).