Following installation/upgrade of the NetBrain Integrated Edition platform, the NetBrain Administrator has been asked to enable HTTPS for the Netbrain End User Interface.
This article describes the procedure for enabling HTTPS on the NetBrain Web Server.
Pre-Requisites
- NetBrain Administrator has SSL files to enable HTTPS for Web server. If the SSL file set is not available, NetBrain supports self-signed certificate file.
- NetBrain Administrator has root access to all the Linux server(s)
- NetBrain Administrator has administrator access to the NetBrain Windows server(s)
- NetBrain Administrator has the System Administrator account credential for NetBrain System Administrator user interface
- NetBrain Web Server service is currently deployed and functional on port 80
Procedure
Web Server
1. Log onto the Window server which had installed NetBrain Web API server(together with Web Server) with Administrator account, open Server Manager. Select Tools on the right top corner and open Internet Information Services (IIS) Manager, as following:
2. In the IIS Manager, select the Server from the left tab and click on Server Certificates from the Menu.
From the Right Side Menu, click 'Import...' to import the new issued Certificate file prepared by customer.
If no such file available, we can click on Create Self-Signed Certificate... and follow below procedures to generate a Self-Signed Certificate file to enable HTTPS.
Enter the name of your choice (here we are using Test) and click OK to complete the creation of a self-signed certificate
By default, a Self-Signed Certificate file will expire in 1 year
3. Click on the Web Site Name (Default Web Site) which can be found by opening the Sites folder:
Click on Bindings... from the Right Side tab to start binding the certificate imported or created in the above step#2:
4. In the Site Bindings dialog, click Add... to create a new binding:
In the 'Add Site Binding' dialog, change the type to https, and under SSL Certificate → open the drop-down menu and select the certificate name, as following:
Don't fill anything in the 'Host name' because this will enforce verification of the hostname issued to the Cert. file. Client side could not connect to Web API server if it is set.
5. Click OK to save the new binding rule and close the dialog 'Site Bindings'.
If you just want to enable HTTPS for NetBrain Web Server, remove the default existing rule accepting connections on port 80.
6. Go back to the 'Default Web Site Home' page, click the 'SSL Settings', as following:
Uncheck the 'Require SSL' and change the 'Client certificates' to 'Ignore' like below and then click 'Apply' in the right Action panel to save the change.
7. In the left connections panel, expend the 'Default Web Site' and click 'ServicesAPI' site as following:
In the '/ServicesAPI Home' page, click the 'SSL Settings', as following:
Uncheck the 'Require SSL' and change the 'Client certificates' to 'Ignore' like below and then click 'Apply' in the right Action panel to save the change.
Following this final configuration, the NetBrain Web Server is now HTTPS enabled.
KC Proxy Service
1. Log onto the Window server which had installed NetBrain KC Proxy service (together with Web API Server) with Administrator account, run below command to ensure that the hostname with domain name of the Web Server to which the Cert file was issued to could be solved:
ping HOSTNAME.DOMAIN.NAME
In below example, the Full Qualified Domain Name of the Web Server is nbwebserver.ABC.com so that user can access the Web Server using URL: https://nbwebserver.ABC.com/, and the above command is:
ping nbwebserver.ABC.com
2. Go to the NetBrain installation folder and explore to the KCProxy folder (default is C:\ProgramFiles\NetBrain\KCProxy\kcproxy\), open the config file app.conf and modify the URL of NEtBrain IE Web API Service to https://HOSTNAME.DOMAIN.NAME/ServicesAPI, as following:
3. Save the file and restart the service 'NetBrainKCProxy'.
Service Monitor
1. Log onto the server which had installed NetBrain Service Monitor service with Administrator (for Windows) or root (for Linux) user, run below command to ensure that the hostname with domain name of the Web Server to which the Cert file was issued to could be solved:
ping HOSTNAME.DOMAIN.NAME
In this example, the command is:
ping nbwebserver.ABC.com
2. Update all the api_url in Service Monitor's configuration file 'agent.conf' on all Linux and Windows servers, then save the file as following:
Linux: /etc/netbrain/nbagent/agent.conf
Windows: C:\ProgramData\Netbrain\nbagent\agent.conf
3. Restart Service Monitor service on each server to complete the change.
4. Log onto the Service Monitor portal to confirm system running status and service running status are normal after restarting SM services.
Website Base URL in System Administration Interface (Applicable to IE 8.02+)
1. Using the 'Sys Admin' account credential to log onto the NetBrain Sys Admin portal;
2. Open the 'Advanced Setting' tab and correct the 'Site Configuration' using the https URL as following:
3. Save the settings.