In this article:

Setting Up Interaction of Client with Web Server and Web Server with BI Server via the HTTPS Protocol

Setting Up Interaction of Client with Web Server via the HTTPS Protocol

Step 1. Place and Install Security Certificates

Step 2. Import Root Certificate to Store

Step 3. Set Up Web Server

Step 4. Open Web Application via HTTPS Protocol

Setting Up Web Application to Work via HTTPS

Hypertext Transfer Protocol Secure (HTTPS) is an extension of the Hypertext Transfer Protocol (HTTP) that uses Transport Layer Security (TLS) protocol encryption. The TLS protocol is cryptographic and is used to create a secure communication channel between computers in network. Cryptographic methods ensure confidentiality and integrity of transmitted data, one-way or two-way authentication.

Security certificates are used to ensure trust between the server and client communicating via HTTPS protocol. Security certificates include a set of information about the certificate owner, the certificate owner's public key, the subject that issued and signed the certificate, and information for certificate validation.

The following types of security certificates are required to ensure communication between the server and the client via HTTPS protocol:

Foresight Analytics Platform also supports web application work via HTTPS protocol with the use of GOST encryption. The GOST encryption requires the use of cryptographic information protection tools (CIPT): CryptoPro CSP, ViPNet CSP, Crypto-COM, MagPro CryptoPacket, and others. CIPT must be compatible with operating environment of Foresight Analytics Platform and must be installed both on web application server and client device. CIPT are not included in Foresight Analytics Platform setup software package. Web application work via HTTPS protocol using the GOST encryption is set up in accordance with the documentation for the corresponding CIPT.

For details about web application work in the Chromium-Gost browser using CryptoPro CSP, see to the Setting Up Web Application to Work in Chromium-Gost Browser section.

Set up one of the options of interaction between web application configuration elements:

When working in the web application via the HTTPS protocol additionally set up web forms, to work via the WebSocket protocol. For details see the Setting Up Web Forms via HTTPS section.

Setting Up Interaction of Client with Web Server and Web Server with BI Server via the HTTPS Protocol

Consider setting up interaction of client with web server and web server with BI server via the HTTPS protocol in Linux OS. Web server and BI server can be located on one physical server or one different ones.

To set up interaction of client with web server and web server with BI server via the HTTPS protocol:

  1. Make sure that there are the following directories in the system:

NOTE. The specified directories are created by default during web application setup.

  1. Determine DNS name of server:

sudo hostnamectl set-hostname <DNS name of server>

  1. Download and unpack the enable_https.zip archive. Place the enable_https.sh script in the /home/<user name> home directory.

  2. Open the enable_https.sh script for edit and change values of preconfigured parameters if the system contains a set of ready security certificates:

CERT_DIR=./fp-certs
SERVER_CRT_NAME="fp_server.crt"
SERVER_KEY_NAME="fp_server.key"
CA_CRT_NAME="fp_ca.crt"
CA_KEY_NAME="fp_ca.key"

Description of variables:

NOTE. Skip the step to generate automatic self-signed security certificates. Self-signed certificates are linked to the DNS name of server determined at the Step 2.

  1. Change the current directory to the folder with the script:

cd /home/<user name>/enable_https.sh

  1. Grant access permissions for script execution:

sudo chmod +x enable_https.sh

  1. Run the script:

sudo ./enable_https.sh

sudo ./enable_https.sh service

If web server and BI server are located at different physical servers, DNS name of BI server and web server are requested on script execution.

After executing the operations the web application is set up to work via the HTTPS protocol. If designer of business applications back end was set up using the DBA.war archive before web application work setup via the HTTPS protocol, designer of business applications work will also be set up via the HTTPS protocol.

During script execution:

Setting Up Interaction of Client with Web Server via the HTTPS Protocol

Consider setting up interaction of client with web server via the HTTPS protocol. In this case the web server and BI server will communicate via HTTP protocol. It is assumed that the web server and BI server are located on the same physical server.

Step 1. Place and Install Security Certificates

NOTE. Before executing the step see the certification authority service provider guide and the operating system documentation.

To place and install security certificates:

  1. Generate and save the server.key private key of the certificate.

  2. Create a request to get the domain_name.csr server certificate.

  3. Get the server.cer server certificate for Linux OS or the server.pfx server certificate for Windows OS signed by the certification authority that is trusted by all system users.

  4. Get the ca.cer root certificate and subca.cer intermediate certificates if they are in the trust chain.

  5. Place the certificates and keys for installation:

TIP. It is recommended to include certificates of intermediate certification authorities to the server certificate file and exclude the root certificate from the server certificate. If required, change the server certificate file in a text editor.

The specified certificate and key files are given as an example and may differ.

Step 2. Import Root Certificate to Store

To import a root certificate to the trusted root certification authority store, use the supported browser or operating system tools. Operating system tools can be used to import certificate to store only in Windows OS.

Consider certificate import in Mozilla Firefox:

  1. Open browser settings at:

about:preferences

  1. Open the Privacy and Security section.

  2. Click the View Certificates button in the Certificates subsection. The Certificate Manager dialog box opens.

  3. Click the Import button on the Authorities tab. A standard file selection dialog box opens.

  4. Select the ca.cer root certificate. The Load Certificate dialog box opens.

  5. Select the trust This CA to Identify Websites checkbox.

After executing the operations the root certificate is imported to the trusted root certification authority store.

To import the root certificate to a trusted root certification authority store using Windows OS tools:

  1. Double-click the ca.cer root certificate. The Certificate dialog box opens.

  2. Click the Install Certificate button. The certificate import wizard opens.

  3. Select the Current User store location and click the Next button.

  4. Select the Place All Certificates to the Following Store radio button, select the Trusted Root Certification Authorities certificate store in the Select Certificate Store dialog box and click the Next button.

After executing the operations the root certificate is imported to the trusted root certification authority store.

For other options of certificate installation and import in various operating systems and browsers see the public services portal.

Step 3. Set Up Web Server

Setup steps differ depending on the web server and operating system in use.

To set up Apache2 web server in Linux OS:

  1. Connect the mod_ssl module:

    • Debian-based distributions:

sudo a2enmod-fp10.x-web ssl
sudo a2ensite-fp10.x-web default-ssl

    • RedHat-based distributions:

sudo yum install -y mod_ssl
sudo cp /etc/httpd/conf.modules.d/00-ssl.conf /etc/httpd-fp10.x-web/conf.modules.d/
sudo systemctl restart httpd-fp10.x-web

    • ALT Linux:

sudo apt-get install -y apache2-mod_ssl
sudo cp /etc/httpd2/conf/mods-available/ssl.load /etc/httpd2-fp10.x-web/conf/mods-available/
sudo /usr/sbin/a2enmod-fp10.x-web ssl
sudo systemctl condreload httpd2-fp10.x-web.service

After executing the operations the mod_ssl module is connected. For details about the module see the Apache2 documentation.

In RedHat-based distributions the /etc/httpd-fp10.x-web/conf.d/ssl.conf configuration file is created with the module connection string:

LoadModule ssl_module modules/mod_ssl.so

In ALT Linux the /etc/httpd2-fp10.x-web/conf/mods-enabled/ssl.load configuration file is created with the module connection string:

LoadModule ssl_module /usr/lib64/apache2/modules/mod_ssl.so

  1. Add SSL parameters to the <VirtualHost> section in the web server configuration file:

    • /etc/apache2-fp10.x-web/sites-available/webserver.conf in Debian-based distributions.

    • /etc/httpd-fp10.x-web/conf.d/00-virtualhost.conf in RedHat-based distributions.

    • /etc/httpd2-fp10.x-web/conf/sites-enabled/000-default.conf in ALT Linux.

SSLEngine On
SSLCertificateFile <path to folder>/server.cer
SSLCertificateKeyFile <path to folder>/server.key
SSLProxyEngine On

In the <path to folder> substitution specify the folder with the server certificate and its private key.

NOTE. Add additional TLS protocol parameters generated using the SSL Configuration Generator tool.

  1. Change HTTP protocol to HTTPS in the web application configuration files /opt/foresight/fp10.x-webserver/r/config/config.json, /opt/foresight/fp10.x-webserver/config/PP.xml and make sure that the following conditions are satisfied:

    • The config.json file contains URL of the PPService.axd web service in the serviceUrl field.

    • The PP.xml file contains the <proxy> section.

The example of the config.json file:

{
  "targetRepo": "",
  "serviceUrl": "https://<DNS name of server>:8110/fp10.x/app/PPService.axd",
  "locale": "ru",
  "locales": ["ru"],
  "title": "FAP10",
  "baseUrl": "https://<DNS name of server>:8110/fp10.x/",
  "themes": ["fap10"]
}

The example of the PP.xml file:

<?xml version="1.0" encoding="utf-8"?>
<pp>
    <proxy url="" />
    <metabase id="WAREHOUSE" />
    <serviceCM ParamsUrl="https://<DNS name of server>:8110/fp10.x/r/#/settings"/>
    <modules commonModulesUrl="https://<DNS name of server>:8110/fp10.x/r/#">
    </modules>
</pp>

  1. Restart the web server:

    • Debian-based distributions:

sudo systemctl restart apache2-fp10.x-web

    • RedHat-based distributions:

sudo systemctl restart httpd-fp10.x-web

    • ALT Linux:

sudo systemctl restart httpd2-fp10.x-web

After executing the operations the Apache2 web server is set up.

To set up IIS web server in Windows OS, open the home page of the IIS manager and execute the operations:

  1. Open the Server Certificates feature in the IIS section by double-click or using the Open Feature context menu item.

  2. Select the Import item on the Actions panel. The Import Certificate dialog box opens:

  1. Set the parameters:

    • Certificate File (.pfx). Specify path to the server certificate server.pfx.

    • Password. Specify the password that was used on server certificate creation.

    • Select Certificate Store. Select the Web Hosting option in the drop-down list.

  1. Click the OK button.

  2. Select the site in the Sites list and select the Bindings item on the Actions panel. The Site Bindings dialog box opens.

  3. Click the Add button. The Add Site Binding dialog box opens:

  1. Set the parameters:

    • Type. Select the https option in the drop-down list.

    • SSL Certificate. Select the server corresponding to the imported server certificate in the drop-down list.

  2. Add TLS protocol parameters to the registry using the IIS Crypto utility.

  3. Change the HTTP protocol to HTTPS and make sure that DNS name of server is specified in the web application configuration files PP.xml, config.json.

  4. Select the server in the Connections list and select the Restart item on the Actions panel.

After executing the operations the IIS web server is set up.

Step 4. Open Web Application via HTTPS Protocol

To open the web application via HTTPS protocol, use the supported browser and specify URL in the connection string:

https://<DNS name of server>:8110/fp10.x/r/

https://<DNS name of server>/FP_App_v10.x/r/

See also:

Setting Up Web Application Configuration | Opening Web Application