Versions Compared

Old Version 8

changes.mady.by.user John McKeever

Saved on

compared with

New Version 9

changes.mady.by.user John McKeever

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Creating a Java key store containing your HTTPS certificate

Before configuring Workbench to use HTTPS a Java Key Store containing the HTTPS certificate must be created. Java key stores can be created and managed using the keytool command included with all installations of Java can be used to create and manage this key store.

Table of Contents

First ensure that you use the keytool command shipped with the Java v1.8 package you downloaded to support MettleCI. On Unix you You can check your shell’s command line’s default keytool using the which command:

Code Block

operating-specific commands:

Expand
titleWindows
Code Block
where  keytool
Expand
titleUnix
Code Block
which keytool

Ensure Verify that the response points to indicates that you will be using the keytool in the correct bin directory (e.g. in your OpenJDK installation).

Next, use the following command to create a keystore containing a basic self-signed certificate:

Code Block
languagebash
keytool -genkey -keyalg RSA -alias workbench -keystore <path to keystore> -storepass <store password> -storetype PKCS12 -keysize 2048 -sigalg SHA256withRSA -dname "CN=<host url>"

Please replace the <placeholders> in this command based on the following descriptions:

Placeholder

Description

Example Value

path to key store

Full qualified path of the key store to be created

/opt/dm/mci/workbench.p12

store password

Password required when reading or writing to the newly created key store

Choose a random password string. Note that the key stores supplied with Java have a default password of changeit.

host url

The domain name of the URL that will be used to access Workbench in your browser. This does not include the protocol or port numbers. For example, datamigrators.com

your-engine.yourdomain.com

For example, this command creates a keystore called /opt/dm/mci/workbench.p12 for use with workbench currently accessed using URL http://my-engine.datamigrators.com:8080:

Expand
titleWindows
Code Block
languagebash
keytool -genkey -keyalg RSA -alias workbench -keystore C:\dm\mci\workbench.p12 -storepass changeit -storetype PKCS12 -keysize 2048 -sigalg SHA256withRSA -dname "CN=my-engine.datamigrators.com"

If you need to export your certificate for signing you can use a command like the following:

Code Block
keytool -certreq -keyalg RSA -alias workbench -keystore /opt/dm/mci/workbench.p12 -storepass changeit -sigalg SHA256withRSA -file /opt/dm/mci/workbench.csr
Expand
titleUnix
Code Block
languagebash
keytool -genkey -keyalg RSA -alias workbench -keystore /opt/dm/mci/workbench.p12 -storepass changeit -storetype PKCS12 -keysize 2048 -sigalg SHA256withRSA -dname "CN=my-engine.datamigrators.com"

Ensure that your keystore has at least 644 (rw-r--r--) privileges. If you need to export your certificate for signing you can use a command like the following:

Code Block
keytool -certreq -keyalg RSA -alias workbench -keystore C:\dm\mci\workbench.p12 -storepass changeit -sigalg SHA256withRSA -file C:\dm\mci\workbench.csr

Note that the keytool will not normally return a value to the console.

Enabling HTTPS support

Once a key store containing the Workbench HTTPS has been created, update /opt/dm/mci/config.yml and add the following section:

Code Block
server:
  applicationConnectors:
    - type: https
      port: 8443
      keyStoreType: PKCS12
      keyStorePath: <path to keystore>
      keyStorePassword: <store password>
      trustStoreType: PKCS12
      trustStorePath: <path to keystore>
      trustStorePassword: <store password>

The <place holders> must match those used while creating the Java keytool and restart your Workbench service using

Code Block
sudo service dm-mettleci-workbench restart

Verify Workbench is up and running by navigating to https://<host url>:8443 in your browser

Enabling concurrent HTTP and HTTPS support

Under some circumstances, you may wish to allow Workbench to communicate over both HTTP and HTTPS protocols. This can be achieved by adding the following section to /opt/dm/mci/config.yml:

Code Block
server:
  applicationConnectors:
    - type: http
      port: 8080
    - type: https
      port: 8443
      keyStoreType: PKCS12
      keyStorePath: <path to keystore>
      keyStorePassword: <store password>
      trustStoreType: PKCS12
      trustStorePath: <path to keystore>
      trustStorePassword: <store password>

The <place holders> must match those used while creating the Java keytool and restart your Workbench service using

Code Block
sudo service dm-mettleci-workbench restart

Verify Workbench is up and running by navigating to https://<host url>:8443 and http://<host url>:8080 in your browser.