Configuring the JOC Cockpit

Note that it is not necessary to configure the JOC Cockpit - it runs out-of-the-box. The default configuration:

...

• HTTPS connections that encrypt communication between clients, e.g. user browsers, and the JOC Cockpit. In addition, refer to the JOC Cockpit - Two-factor Authentication article.
• HTTPS connections between JOC Cockpit and Controller instances for mutual authentication.

Security: Use with HTTPS Connections

By default, the JOC Cockpit is configured for connections using the HTTP and the HTTPS protocols. HTTPS connections are used in two ways:

...

Provide Keystore, Truststore and Configuration

Connections to JOC Cockpit instances are established from a client, e.g. a user browser. If the HTTPS protocol is used then note that clients have to hold the server certificate in their truststore. For CA signed server certificates, clients can use the root CA certificate or intermediate CA certificate that signed the server certificate.

...

The default configuration of JOC Cockpit ships with the above keystore and truststore files. Users can add their private keys and certificates to the relevant keystore/truststore. The corresponding configuration items are in place by default. 

JOC Cockpit Keystore and Truststore for Client Connections

• The JOC Cockpit instance's start.ini configuration file by default holds the following configuration items. For details see the JS7 - JOC Cockpit Configuration Items article.

  Code Block
  language bash title JOC Cockpit Configuration for Keystore and Truststore Locations with HTTPS Client Connections linenumbers true
  ## Keystore file path (relative to $jetty.base) jetty.sslContext.keyStorePath=resources/joc/https-keystore.p12 ## Truststore file path (relative to $jetty.base) jetty.sslContext.trustStorePath=resources/joc/https-truststore.p12 ## Keystore password jetty.sslContext.keyStorePassword=jobscheduler ## KeyManager password (same as keystore password for pkcs12 keystore type) jetty.sslContext.keyManagerPassword=jobscheduler ## Truststore password jetty.sslContext.trustStorePassword=jobscheduler ## Connector port to listen on jetty.ssl.port=4443

• Keystore and truststore locations:
  • The configuration items listed above specify the locations of the keystore and the truststore.
  • Consider the optional use of a key password and store password for keystores and the use of a store password for truststores.

JOC Cockpit Keystore and Truststore for Controller Connections

• The JOC Cockpit instance's joc.properties configuration file by default holds the following configuration items. For details see the JS7 - JOC Cockpit Configuration Items article.

  Code Block
  language bash title JOC Cockpit Configuration for Controller HTTPS Connections linenumbers true
  ################################################################################ ### Location, type and password of the Java truststore which contains the ### certificates of each JS7 Controller for HTTPS connections. Path can be ### absolute or relative to this file. keystore_path = ../../resources/joc/https-keystore.p12 keystore_type = PKCS12 keystore_password = jobscheduler key_password = jobscheduler truststore_path = ../../resources/joc/https-truststore.p12 truststore_type = PKCS12 truststore_password = jobscheduler

• This setting specifies the location of the keystore and truststore.

Run JOC Cockpit Container for HTTPS Connections

The following additional arguments are required for HTTPS connections:

...

• When using HTTPS connections, consider dropping the HTTP port of the JOC Cockpit instance by omitting the following from the settings listed above:
  • --publish=17446:4446 This mapping should be dropped in order to prevent incoming traffic to the JOC Cockpit instance's HTTP port.

High Availability: Operating a Cluster

JOC Cockpit can be operated as a passive cluster for high availability. 

...