Skip to content

tls

Jump to bottom
Deva Kumar edited this page Apr 27, 2022 · 5 revisions

TLS Support

viya-appserverjs can be configured to support TLS.

This is accomplished by the following configurations

Make sure VIYA_SERVER is set as https://....

Also make sure that the redirects for your clientid is https://{APPHOST}{APPPORT}/{your-redirect-endpoint} Some examples:

Chrome Browser Settings

This causes more headaches than one would expect :-(

  1. Set the SAMESITE settings to Default. (Note: Make sure SAMESITE in Dockerfiles is None,secure)
  2. You might have to set this flag to enabled to allow Chrome to accept unsigned certificate from the api server(if that is the setting) Allow invalid certificates for resources loaded from localhost.

At this time, I do not have any information on the other browsers.

APPHOST

Use https when specifying the APPHOST and APPORT as shown below.

APPHOST=https://mymachine
APPPORT=443

You must specify one of the following sets

Set 1: Certificate and key

TLS_KEY=path-to-key
TLS_CERT=path-to-cert

Set 2: Specify in pfx format

TLS_PFX=../certs/sascert/sascert2.pfx
TLS_PW=rafdemo

CA Bundle

Optionally you can also pass in a CA bundle

TLS_CABUNDLE=path-to-your-ca-bundle

Creating self-signed certificate

Before you do that contact your IT to see if they have some standard process to obtain certificates.

You might find the following commands useful if you want to do it yourself.

openssl req -x509 -newkey rsa:2048 -keyout ./certs/key.tmp.pem -out ./certs/certificate.pem -days 365 -nodes -subj "/C=US/ST=NC/L=Cary/O=ORG/OU=DEPT/CN=localhost"
openssl rsa -in ./certs/key.tmp.pem -out ./certs/key.pem

Replace the values in the subj strign with values appropriate for your use case ex: /C=US/ST=NC/L=Cary/O=ACME/OU=MKT/CN=acme.apps.com

Some links I found useful

Table of Contents

Clone this wiki locally