Scope
- The connection to the JOC Cockpit can be secured by HTTPS.
- The connection to the JobScheduler Master can be secured by HTTPS.
- This article describes the steps required to set up secure HTTPS communication in Jetty and in the JobScheduler Master.
Prerequisites
The only prerequisite is to have the Java keytools installed with your Java JRE.
General
The article uses JOC_HOME
, JETTY_HOME
and JETTY_BASE
as environment variables which locate three directories. If you installed Jetty with the JOC installer then
JOC_HOME
is the installation path which was specified during the JOC installation- C:\Program Files\sos-berlin.com\joc (default on Windows)
- /opt/sos-berlin.com/joc (default on Linux)
JETTY_HOME
=JOC_HOME
/jettyJETTY_BASE
is Jetty's base directory which was specified during the JOC installation- C:\ProgramData\sos-berlin.com\joc (default on Windows)
- /home/<setup-user>/sos-berlin.com/joc (default on Linux)
Set up a secure connection to JobScheduler Master
- The JobScheduler Master HTTPS web services are only accessible to authenticated users.
The credentials are read from
<scheduler_data>/
config/private/private.conf
where each user has an entry of the formjobscheduler.master.auth.users { USERNAME = "HASHSCHEME:HASHEDPASSWORD" ... }
The HASHSCHEME can be "plain" or "sha512", e.g.
jobscheduler.master.auth.users { eve = "plain:PASSWORD" joe = "sha512:911b0a07a8cacfebc5f1f45596d67017136c950499fa5b4ff6faffa031f3cec7f197853d1660712c154e1f59c60f682e34ea9b5cbd2d8d5adb0c834f963f30de" # "PASSWORD" }
- The user which is used by the JOC Cockpit has to be specified with the JobScheduler ID and has a password as plain text.
- The JobScheduler Master expects HTTP Basic Authentication.
- The HTTPS certificate with its private key is expected in the Java keystore file
<scheduler_data>/config/private/private-https.jks
under the alias "master-https".
Step 1: Create the Java Keystore
- Create the Java Keystore using the Keytools from your Java JRE.
- Generate the Java Keystore with the private key and certificate for the JobScheduler Master and export the certificate to a second Keystore that is later on used by the JOC Cockpit or other HTTPS clients
- If not otherwise configured then JobScheduler Master by default use the password
jobscheduler
for the respective Keystore. - If you choose an individual password for the Master Keystore then adjust the following properties in the
<scheduler_data>/
config/private/private.conf
configuration file:- Explanations
jobscheduler.agent.webserver.https.keystore.file
is used for the path to the Keystorejobscheduler.agent.webserver.https.keystore.password
is used for the Keystore passwordjobscheduler.agent.webserver.https.keystore.key-password
is used for the password of your private HTTPS certificateExample
Sample private.conf filejobscheduler.agent.webserver.https.keystore { file = "C:/ProgramData/sos-berlin.com/jobscheduler/agent110/config/private/private-https.jks" # Backslashes are written twice (as in JSON notation): # file = "\\\\other-computer\\share\\my-keystore.jks" password = "secret" key-password = "secret" }
- Explanations
Step 2: Set up authentication to JobScheduler Master
- The JobScheduler Master HTTPS web services are only accessible to authenticated users.
- The JobScheduler Master expects HTTP Basic Authentication.
The credentials are read from
<scheduler_data>/
config/private/private.conf
where each user has an entry of the formjobscheduler.master.auth.users { USERNAME = "HASHSCHEME:HASHEDPASSWORD" ... }
The
HASHSCHEME
can be "plain" or "sha512", e.g.jobscheduler.master.auth.users { eve = "plain:PASSWORD" joe = "sha512:911b0a07a8cacfebc5f1f45596d67017136c950499fa5b4ff6faffa031f3cec7f197853d1660712c154e1f59c60f682e34ea9b5cbd2d8d5adb0c834f963f30de" # "PASSWORD" }
The user which is used by the JOC Cockpit has to be specified with the JobScheduler ID and has a password as plain text.
Set up a secure connection to JOC Cockpit as a web application in Jetty
Step 1: Add the https module in Jetty
- add https module on Windows
java -jar "%JETTY_HOME%\start.jar" -Djetty.home="%JETTY_HOME%" -Djetty.base="%JETTY_BASE%" --add-to-start=https
add https module on Linuxjava -jar "$JETTY_HOME/start.jar" -Djetty.home="$JETTY_HOME" -Djetty.base="$JETTY_BASE" --add-to-start=https
- After above call you get a new folder
JETTY_BASE
/etc- Jetty expects in this folder a keystore with the name "keystore" as default.
You can copy the
JETTY_HOME
/etc/keystore toJETTY_BASE
/etc/keystore as workaround but you should use your own keystore for later on (see step 2). In particular, the keystore fromJETTY_HOME
/etc/keystore expires after a short time.Jetty doesn't start if it doesn't find a keystore corresponding its settings.
- Further some entries in the
JETTY_BASE/start.ini
for SSL setting such as the port are added.
Step 2: Create the Java Keystore for Jetty
- Create the Java Keystore using the Keytools from your Java JRE.
- Generate the Java Keystore with the private key and certificate for the Jetty and export the certificate to the keystore that is later on used by the browsers.
- If not otherwise configured in
JETTY_BASE/start.ini
then ...
Step 3: Configure the Java Keystore