Setting up the Admin Console to use SSL

If the installation is intended for production, we strongly recommend for safety reasons to set up the eperi sEcure Admin Console to use SSL/TLS.

1. Connect to the target server using your preferred ssh tool (e.g. putty) and log in.
2. Copy your SSL certificate to a suitable location, e.g:

   sudo cp /home/admin/sslcerts/keystore.p12 /etc/eperi/gateway/tomcat

   Note: This can be the same key store that you use for the reverse proxy.
3. Edit the Tomcat server configuration file as follows:
   1. Open the file server.xml in the editor:

      sudo vi /etc/eperi/gateway/tomcat/server.xml

   2. Within the file server.xml, search for the section <Service name="Catalina">.
      Immediately below this, you should see <Connector port "8080" />.
   3. Add the following after the <Connector Port "8080" /> section:

      <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
      maxThreads="150" scheme="https" secure="true"
      clientAuth="false"
      keystoreFile="/etc/eperi/gateway/tomcat/keystore.p12" keystorePass="XXXXXXX" keystoreType="PKCS12"
      sslEnabledProtocols="TLSv1.2+TLSv1.3"
      ciphers="TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,ECDHE-ECDSA-AES128
      -GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,
      ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE-RSA-CHACHA20-POLY1305,DHE-RSA-AES128-GCM-SHA256,DHE-RSA-AES256
      -GCM-SHA384"
      />

      Be sure to enter the correct location of the certificate, and the password that corresponds to the key store (as highlighted above).

      The above configuration specifies that port 8443 will be used to access the Admin Console. The new URL would be something like https://demo.eperi-cdp.com:8443.
   4. Save your changes.
4. To test this new URL, first restart the entire eperi sEcure Platform as follows:
   Important: Before you (re)start the Postfix SMTP Relay, please make sure that the eperi sEcure Platform is up and running. This is the case if you can access the log-in page of the eperi sEcure Platform Admin Console.

   sudo systemctl restart eperi-gateway
   sudo systemctl restart postfix
   sudo systemctl restart eperi-milter

   Important: In a cluster setup, the changes must be made on every eperi sEcure Platform instance and each eperi sEcure Platform instance must be restarted.
5. Try connecting to the new URL over HTTPS, e.g. https://demo.eperi-cdp.com:8443.

   Once you have tested that the Admin Console can be accessed using port 8443 over SSL, it is recommended that you disable HTTP access via port 8080.

6. Disable the HTTP access via port 8080 by simply commenting out or deleting the existing section (as below) in the Tomcat server configuration (server.xml):

   <Connector port="8080" protocol="HTTP/1.1"
   connectionTimeout="20000"
   redirectPort="8443" />