Product Knowledge Base

Space shortcuts

Page tree

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 2 Next »

Scope

  • The connection to the JOC Cockpit can be secured by HTTPS.
  • The connection to the JobScheduler Master can be secured by HTTPS.
  • This article describes the steps required to set up secure HTTPS communication in Jetty and in the JobScheduler Master.

Prerequisites

The only prerequisite is to have the Java keytools installed with your Java JRE.

General

The article uses JOC_HOME, JETTY_HOME and JETTY_BASE as environment variables which locate three directories. If you installed Jetty with the JOC installer then

  • JOC_HOME is the installation path which was specified during the JOC installation
    • C:\Program Files\sos-berlin.com\joc (default on Windows)
    • /opt/sos-berlin.com/joc (default on Linux)
  • JETTY_HOME = JOC_HOME/jetty
  • JETTY_BASE is Jetty's base directory which was specified during the JOC installation
    • C:\ProgramData\sos-berlin.com\joc (default on Windows)
    • /home/<setup-user>/sos-berlin.com/joc (default on Linux)

Set up a secure connection to JOC Cockpit as a web application in Jetty

Step 1: Add the https module in Jetty

  • add https module on Windows
    java -jar "%JETTY_HOME%\start.jar" -Djetty.home="%JETTY_HOME%" -Djetty.base="%JETTY_BASE%" --add-to-start=https
    add https module on Linux
    java -jar "$JETTY_HOME/start.jar" -Djetty.home="$JETTY_HOME" -Djetty.base="$JETTY_BASE" --add-to-start=https
  • After above call you get a new folder JETTY_BASE/etc
    • Jetty expects in this folder a keystore with the name "keystore" as default.

    • You can copy the JETTY_HOME/etc/keystore to JETTY_BASE/etc/keystore as workaround but you should use your own keystore for later on (see step 2). In particular, the keystore from JETTY_HOME/etc/keystore expires after a short time.

      Jetty doesn't start if it doesn't find a keystore corresponding the settings.

  • Further some entries in the JETTY_BASE/start.ini for SSL setting such as the port are added.

Step 2: Create the Java Keystore for Jetty

  • Create the Java Keystore using the Keytools from your Java JRE.
    • Generate the Java Keystore with the private key and certificate for the Jetty and export the certificate to the keystore that is later on used by the browsers or other https clients.
    • If not otherwise configured in ....
    • if you choose an individual password for the Agent Keystore then adjust the following properties in the <agent_data>/config/private/private.conf configuration file:
      • Explanations
        • jobscheduler.agent.webserver.https.keystore.file is used for the path to the Keystore
        • jobscheduler.agent.webserver.https.keystore.password is used for the Keystore password
        • jobscheduler.agent.webserver.https.keystore.key-password is used for the password of your private HTTPS certificate

      • Example

Step 3: Configure the Java Keystore

 

  • No labels