Setting Up Web Application Work via HTTPS

Hypertext Transfer Protocol Secure (HTTPS) is an extended version of the Hypertext Transfer Protocol (HTTP) that uses encryption using the Transport Layer Security (TLS) protocol. The TLS protocol is cryptographic and and is used to create a protected communication channel between computers in the network. Cryptographic methods ensure confidentiality and integrity of transferred data, single-factor or two-factor authentication.

Security certificates are used to ensure trust between the server and the client interacting via the HTTPS protocol. Security certificates include a set of information about the certificate owner, the certificate owner's public key, the subject that issued and signed the certificate, and information for certificate validation.

The following security certificate types are required to ensure interaction between the server and the client via the HTTPS protocol:

• Root certificate. It is issued by a Certification Authority (CA). The trust between the server and the client via the root certificate is used to build a chain of trust for other certificates. Therefore, a single trust space is created.

• Intermediate certificate. It is issued by the intermediate certification authority and is signed by the root certification authority or other intermediate certification authority. The hierarchy of certification authorities is used to resolve various private tasks of issuance and maintenance of issued certificates.

• Server certificate. It is used to authenticate the Apache2 web server in Linux OS or IIS in Windows OS.

Foresight Analytics Platform supports web application work via the HTTPS protocol using GOST encryption algorithms. The GOST encryption requires the use of the means of cryptographic information protection: CryptoPro CSP, ViPNet CSP, Crypto-COM, MagPro CryptoPacket, and so on. The means of cryptographic information protection must be compatible with the operation environment of Foresight Analytics Platform and installed both in web application back end and on a client computer. The means of cryptographic information protection are not included in the software package of Foresight Analytics Platform. Web application work setup via the HTTPS protocol using GOST encryption algorithms is executed according to the documentation for corresponding means of cryptographic information protection.

For details about web application work in the Chromium-Gost browser, see the Setting Up Web Application Work in Chromium-Gost Browser in Linux OS section.

Set up one of the options of interaction between system configuration elements:

• Browser > HTTPS > web application back end > HTTPS > BI server.

• Browser > HTTPS > web application back end > HTTP > BI server.

When the web application works via the HTTPS protocol, also set up the work of web forms that use the WebSocket protocol. For details see the Setting Up Web Forms Work via HTTPS section.

Setting Up Interaction between System Configuration Elements via the HTTPS Protocol in Linux OS

Consider setting up interaction between the system configuration elements: browser > HTTPS > web application back end > HTTPS > BI server. The web application back end and the BI server may be located one the same physical server or on different ones.

To set up interaction between system configuration elements via the HTTPS protocol in Linux OS:

1. Make sure that the system contains the following folders:

Directory	Description
/opt/foresight/fp10.x-biserver	Main files of BI server.
/etc/apache2-fp10.x in Debian-based distributions /etc/httpd-fp10.x in RedHat-based distributions /etc/httpd2-fp10.x in ALT Linux	Configuration files of Apache2 web server instance with installed BI server.
/opt/foresight/fp10.x-webserver	Main files of web application back end.
/etc/opt/foresight/fp10.x-webserver	The additional configuration file envvars of Apache web server instance, on which web application back end is installed, to ser environment variables.
/etc/apache2-fp10.x-web in Debian-based distributions /etc/httpd-fp10.x-web in RedHat-based distributions /etc/httpd2-fp10.x-web in ALT Linux	Configuration files of the Apache2 web server instance, on which web application back end is installed.

NOTE. The specified folders are created by default during web application installation.

2. Determine DNS name of the server:

sudo hostnamectl set-hostname <DNS name of the server>

3. Download and unarchive the enable_https.zip archive. Place the enable_https.sh script in the home folder /home/<user name>.

4. Replace the current directory with the directory with the script:

cd /home/<user name>

5. Grant access permissions for script execution:

sudo chmod +x enable_https.sh

6. Open the enable_https.sh script for edit and change values of preconfigured parameters if the system contains a set of ready security certificates:

CERT_DIR=./fp-certs
SERVER_CRT_NAME="fp_server.crt"
SERVER_KEY_NAME="fp_server.key"

Description of variables:

• CERT_DIR. The path to the folder with the security certificate. The default path: ./fp-certs.

• SERVER_CRT_NAME. Server certificate file name with the *.crt extension. The default name: fp_server.crt.

• SERVER_KEY_NAME. Name of the server certificate private key with the *.key extension. The default name: fp_server.key.

NOTE. Skip the step if the system contains no ready security certificates.

7. Run the script with the service parameter if the serviceUrl field in the config.json file contains the PP.SOM web service URL:

sudo ./enable_https.sh service

If the field contains the PPService.axd request handler URL, run the script without the parameter:

sudo ./enable_https.sh

If web application back end and BI server are located on different physical servers, the following will be requested during script execution:

• DNS name of the server, on which the BI server is installed.

• DNS name of the server, on which the web application back end is installed.

If the Step 6 was skipped, after running the script select the security certificate generation method:

• Generate a self-signed server certificate. When this method is selected, the /home/<user name>/fp-certs directory is created with self-signed security certificates: server certificate fp_server.crt; private key of the server certificate fp_server.key; root certificate fp_ca.crt; private key of the root certificate fp_ca.key. The self-signed certificates are linked to the DNS name of the server determined at the Step 2. Validity period of self-signed certificates is 1024 days.

IMPORTANT. Self-signed security certificates must not be used in the production environment.

• Generate a request for issuing the server certificate ./fp-certs/fp_server.csr. If this method is used, enter the requested information in the interactive mode. The fp_server.key private key file of the server is created automatically in the fp-certs folder during generation of request for issuing server certificate. Get the *.crt server certificate file and execute the operations:

1. Place the obtained server certificate file in the fp-certs.

2. Change values of the predefined script parameters if required.

3. Run the script again.

After executing the operations the web application is set up to work via the HTTPS protocol.

During the script execution:

• HTTP is changed for HTTPS:

• In the web application configuration file /opt/foresight/fp10.x-webserver/r/config/config.json.

• In the value of the PP_SOM variable in the /etc/opt/foresight/fp10.x-webserver/envvars file.

• The <VirtualHost *:8810> section with SSL parameters and CORS settings is added in the configuration file of the Apache2 web server instance, on which the BI server is installed:

• /etc/apache2-fp10.x/mods-available/fp10.x-biserver.conf in Debian-based distributions.

• /etc/httpd-fp10.x/conf.d/fp10.x-biserver.conf in RedHat-based distributions.

• /etc/httpd2-fp10.x/conf/mods-enabled/fp10.x-biserver.conf in ALT Linux.

• SSL parameters and paths to security certificates are added in the <VirtualHost *:8110> section of the configuration file of the Apache2 web server instance, on which the web application back end is installed:

• /etc/apache2-fp10.x-web/sites-available/webserver.conf in Debian-based distributions.

• /etc/httpd-fp10.x-web/conf.d/00-virtualhost.conf in RedHat-based distributions.

• /etc/httpd2-fp10.x-web/conf/sites-enabled/000-default.conf in ALT Linux.

• The server certificate and its private key are copied from the directory specified in the CERT_DIR variable to the /opt/foresight/ssl/ directory.

• The *.bak files are added to save backup copies of the changed files. Each file is created in the directory with changed file. For example, the file /opt/foresight/fp10.x-webserver/r/config/config.json.bak containing settings before script execution.

Setting Up Interaction between Browser and Web Application Back End via the HTTPS Protocol

COnsider setting up interaction between the system configuration elements: browser > HTTPS > web application back end > HTTP > BI server. It is assumed that the web application back end and the BI server are located on the same physical server.

Step 1. Placement and Installation of Security Certificates

NOTE. Before executing the step see the guide of certification authority service provider and the operating system documentation.

To place and install security certificates:

1. Generate and save the server.key server certificate private key.

2. Create a request to issue the domain.csr server certificate.

3. Get the server.cer server certificate for Linux OS or the server.pfx server certificate for Windows OS signed by the certification authority that is trusted by all users.

4. Get the ca.cer root certificate and subca.cer intermediate certificates if they are in the chain of trust.

5. Place the certificates and keys for installation:

• On the local user computer place the ca.cer root certificate file.

• On the server, on which the web application back end is installed, place the server.key server certificate private key file, the server.cer server certificate file in Linux OS or the server.pfx server certificate file in Windows OS.

TIP. It is recommended to include certificates of intermediate certification authorities to the server certificate file and exclude the root certificate from it. If required, change the server certificate file in the text editor.

The specified certificate and key files are given as an example and may differ.

Step 2. Import of Root Certificate to Store

To import the root certificate to a trusted root certification authority store, use supported browser or operating system tools. Operating system tools can be used to import certificate to store only in Windows OS.

Consider certificate import in Mozilla Firefox:

1. Open browser settings at:

about:preferences

2. Open the Privacy and Security section.

3. Click the View Certificates button in the Certificates subsection. The Certificate Manager dialog box opens.

4. Click the Import button on the Authorities tab. A standard file selection dialog box opens.

5. Select the ca.cer root certificate. The Load Certificate dialog box opens.

6. Select the trust This CA to Identify Websites checkbox.

After executing the operations the root certificate is imported to the trusted root certification authority store.

To import the root certificate to a trusted root certification authority store using Windows OS tools:

1. Double-click the ca.cer root certificate. The Certificate dialog box opens.

2. Click the Install Certificate button. The certificate import wizard opens.

3. Select the Current User store location and click the Next button.

4. Select the Place All Certificates to the Following Store radio button, select the Trusted Root Certification Authorities certificate store in the Select Certificate Store dialog box and click the Next button.

After executing the operations the root certificate is imported to the trusted root certification authority store.

For other options of certificate installation and import in various operating systems and browsers see the public services portal.

Step 3. Setting Up Web Application Back End

Setup steps differ depending on the web server, on which the web application back end is installed, and the operating system in use.

Step 4. Opening Web Application via the HTTPS Protocol

To open the web application via the HTTPS protocol, use the supported browser and specify the address in the connection string:

• In Linux OS:

https://<web server>:<port number>/fp10.x/r/

• In Windows OS:

https://<web server>:<port number>/FP_App_v10.x/r/

Where:

• <web server>. DNS name of the server, on which web application back end is installed.

• <port number>. Number of the port, at which web application back end is available. The 443 port is used by default.

NOTE. As a result of web application setup via the HTTPS protocol, in Linux OS the 8110 port should be used instead of 443.