Enabling HTTPS connectivity for the nodes

The default certificate presented by the application server uses localhost.localdomain. This works only for local node installations (server and node on a single host).

Note:

• For local connectivity between node and server, you can use the default certificate - remember that you may need to use the ./node_add_ssl_cert.sh script (in /opt/vprotect/node/scripts directory ) after future updates to refresh the certificate on the node

• Default password for our keystore is changeit

• if you just want to connect local node over HTTPS using the default certificate - jump to the Node configuration and use the localhost.localdomain instead of the storware.local

• When registering the node locally over HTTPS note that the URL you should use is localhost.localdomain - NOT localhost

• When registering a node via HTTPS, please note that the server must have an FQDN that is different from the IP address (hostname like 10.10.10.10 can be processed incorrectly).

This section presents the steps necessary for generating an SSL certificate, setting up Storware Backup & Recovery to use it and registering a remote node.

Storware Backup & Recovery Server (when using own certificate)

This section describes certificate generation and import on the Storware Backup & Recovery Server side. It uses a self-signed certificate. If you would like to use CSR and your own CA instead, check for additional steps described in the next section.

1. SSH to the Storware Backup & Recovery Server host

2. Change working directory to the /opt/vprotect/server:

   cd /opt/vprotect/server

3. Enable root privileges and generate the key and certificate (remember to provide a valid Storware Server DNS hostname - in our example, it was storware.local):

   openssl req -x509 -newkey rsa:4096 -keyout storware.key -out storware.crt -days 365

   Generating a 4096 bit RSA private key
   ...............................................................................++
   .............................................................................................................................................................................................................................................................................................................................................++
   writing new private key to 'storware.key'
   Enter PEM pass phrase:
   Verifying - Enter PEM pass phrase:
   -----
   You are about to be asked to enter information that will be incorporated
   into your certificate request.
   What you are about to enter is what is called a Distinguished Name or a DN.
   There are quite a few fields but you can leave some blank
   For some fields there will be a default value,
   If you enter '.', the field will be left blank.
   -----
   Country Name (2 letter code) [XX]:PL
   State or Province Name (full name) []:
   Locality Name (eg, city) [Default City]:Warsaw
   Organization Name (eg, company) [Default Company Ltd]: your Company
   Organizational Unit Name (eg, section) []:
   Common Name (eg, your name or your server's hostname) []:storware.local
   Email Address []:

4. Create the PKCS12 bundle from the certificate and the key:

   openssl pkcs12 -export -in storware.crt -inkey storware.key -out storware.p12 -name storware

   You need to input the passphrase defined before and define the export password:

   Enter pass phrase for storware.key:
   Enter Export Password:
   Verifying - Enter Export Password:

5. Create a keystore for the Storware Backup & Recovery Server with the PKCS12 bundle (as a root):

   Note: the default password for our keystore is changeit.

   [root@localhost ~]# keytool -importkeystore -destkeystore /opt/vprotect/server/keystore.jks -srckeystore storware.p12 -srcstoretype PKCS12 -alias storware
   Enter destination keystore password: 
   Re-enter new password: 
   Enter source keystore password:

6. Change ownership of the keystore to the vprotect user:

   chown vprotect:vprotect /opt/vprotect/server/keystore.jks

7. Edit /opt/vprotect/server/quarkus.properties, change the path to the keystore and password (use the password generated in step 3 of this instruction, the default keystore password is changeit):

   javax.net.ssl.keyStore=/opt/vprotect/server/keystore.jks
   javax.net.ssl.keyStorePassword=[keystorepassword]

8. Restart the Server:

   systemctl restart vprotect-server

Storware Backup & Recovery Node (any SSL certificate)

1. SSH to Storware Backup & Recovery Node host

2. Make sure that your nodes resolve the hostname (FQDN) of the Storware Backup & Recovery Server. You can also add an entry in the /etc/hosts like this (example IP: 1.2.3.4):

   1.2.3.4 storware.local

3. Check with your browser that https://STORWARE_HOST:8181 presents the certificate that you have just generated. You can also execute the OpenSSL client from the node to print it (check the hostname that you have provided in the certificate):

   openssl s_client -connect storware.local:8181 < /dev/null

4. Import the server certificate using the script under the /opt/vprotect/node/scripts folder:

   cd /opt/vprotect/node/scripts
   ./node_add_ssl_cert.sh [SERVER_HOST] [PORT] [KEYSTORE_PASS]

   • [SERVER_HOST] - FQDN name of Storware Backup & Recovery Server

   • [PORT] - port for SSL communication on Storware Backup & Recovery Server (you need to open it on the server # firewall-cmd --permanent --add-port=[PORT]/tcp && firewall-cmd --reload)

   • [KEYSTORE_PASS] - optional - password for your local Java keystore - usually it is changeit and it is the default value

   Note:

   If you have a node on the same host as the server, you could use the default variables of the script (and you can use the script without arguments). Default variables are:

   • SERVER_HOST = 127.0.0.1

   • PORT = 8181

   It applies if you have not generated any certificates. Example:

   ./node_add_ssl_cert.sh storware.local 8181

5. Register the node with the NODE_NAME of your choice, the ADMIN_USER user name which you would like to use and the URL to Storware Backup & Recovery API, and provide the password when prompted:

   vc node inst register --name=NODE_NAME --login=ADMIN_USER --password=ADMIN_PASS --apiurl='https://SERVER_HOST:PORT/api'

   Example:

   vc node inst register --name=node1 --login=admin --password=vPr0tect --apiurl='https://storware.local:8181/api'

Notes on using your own certificate with CSR and your own CA

When using CSR to get a trusted certificate, you need to replace step 2 in Storware Backup & Recovery Server (when using own certificate) with several steps, including CSR generation, and download the CRT signed by your CA. The steps are as follows:

1. Generate the CSR - answer the same set of questions as above: openssl req -new -newkey rsa:2048 -nodes -keyout storware.key -out storware.csr.

2. Send your CSR and have it signed by your CA.

3. Download your CRT file and save it as storware.crt (note that you should have your working directory set to /opt/vprotect/server).

4. Download your CA certificate chain (for example, for a singleca.crt) and import it with the CA_ALIAS of your choice as follows:

   keytool -import -trustcacerts -keystore /usr/lib/jvm/jre/lib/security/cacerts -storepass changeit -noprompt -alias CA_ALIAS -file ca.crt

5. Now, continue from PKCS12 bundle generation (step 3 in the section above).