Stunnel Guide for Trevance 19 April 2017

Transcription

1 Stunnel Guide for Trevance 19 April 2017 This guide is for stunnel.conf version The stunnel.conf version number is near the top of the file. When communicating with the Trevance payment application from a remote server, the communications between the two servers must be secured. Auric requires Trevance be operated behind a secure proxy. Any proxy such as stunnel, Microsoft IIS, nginx, or Apache is suitable. The stunnel proxy service provides a secure wrapper for inbound Trevance HTTPS traffic. Outbound socket connections can also be run through stunnel. The stunnel proxy provides full support for TLSv1.2 and can be upgraded independently of the Trevance application. This allows you to regularly upgrade your inbound security without impacting the underlying Trevance application. From the stunnel.org web site, Stunnel is a proxy designed to add TLS encryption functionality to existing clients and servers without any changes in the programs' code. Its architecture is optimized for security, portability, and scalability (including load-balancing), making it suitable for large deployments. Auric deploys stunnel in several production environments. It is available for many operating systems including Windows, Linux, and OS X. This guide focuses on a Windows deployment. A single stunnel installation can support both Trevance and CN!Express configurations. Please refer to the CN!Express stunnel configuration guide for details. A wide array of stunnel information is available on the Internet. Auric Systems International is a Validated Level 1 PCI Service Provider

2 Data Flow Server Transaction Source Real-time transactions to Trevance Stunnel Config File Sections tr_https Trevance Payment Application tr out Payment Processor The above diagram is a high-level overview of a transaction data flow once stunnel is installed and configured. Transactions are sent via HTTPS (TLSv1.2) to the default Trevance port. Stunnel is configured to accept HTTPS transactions. This configuration is in the tr_https section of the included stunnel.conf file. Stunnel forwards the transaction via HTTP to the local Trevance application. Trevance transforms the request and sends it back to stunnel via a socket connection. Stunnel has configuration sections (tr_xyz_out) for each payment processor connection. Stunnel forwards the transaction via secure socket (TLSv1.2) to the payment processor. Auric Systems International is a Validated PCI Level 1 Service Provider Page 2 of 6

3 Install Stunnel for Windows Download the latest stunnel for Windows from: Confirm the SHA256 signature matches the signature from the download site. The download you choose will have a corresponding signature download file ending in sha256. Run the installer. When prompted to Choose Components, choose the default (Tools and shortcuts). Recommend you accept the default installation location: C:\Program Files (x86)\stunnel. The installer prompts you to create client-side certificates (.pem files). Answer the following questions: Country Name (2 letter code): State or Province Name: Locality Name (city): Organizational Name (company): Organizational Unit Name (typically left blank): Common Name: Hostname of the server running stunnel. Edit the provided stunnel.conf file if necessary (see below). Copy your edited stunnel.conf file to: C:\ Program Files (x86)\stunnel\config\stunnel.conf Restart stunnel. NOTE: The installed stunnel SSL certificate has a one-year lifetime. It will expire in a year. Auric provides a batch file to generate a certificate that is good for ten (10) years. Download the CreateNewStunnelCert.bat batch file from the Auric stunnel download area. Move the batch file into the stunnel configuration directory: C:\Program Files (x86)\stunnel\ Right click CreateNewStunnelCert.bat and select Run as Administrator. Answer the following questions: Country Name (2 letter code): State or Province Name: Locality Name (city): Organizational Name (company): Organizational Unit Name (typically left blank): Common Name: Hostname of the server running stunnel. The new ten (10) year certificate is generated and installed. Auric Systems International is a Validated PCI Level 1 Service Provider Page 3 of 6

4 Running stunnel as an Application After the initial installation, it is useful to run stunnel as an application (vs. a service). Start stunnel from: Start>All Programs>stunnel>stunnel GUI start Running stunnel as a service allows you to quickly restart it and to also view the generated log files while working on the initial Trevance configuration. Running stunnel as a Service Install the stunnel service from the Start menu. Then use normal services controls. Start>All Programs>stunnel Service Install Configure the Trevance Application Use the Trevance configuration utility to set the Web Interface Settings as follows: Server Port: Server IP: All Host Interfaces These settings allow Trevance to listen to the default stunnel configuration. Auric Systems International is a Validated PCI Level 1 Service Provider Page 4 of 6

5 The stunnel.conf Configuration File The configuration file can be edited with a standard text editor (e.g., Notepad or Notepad++). Do not use a word processor such as WordPad or Word. General Settings The logging levels are controlled by the debug line. Values can be from 0 through 7. 0 logs only catastrophic messages and 7 logs a lot of debug information. The default setting is 5. You may want to set this to 6 (or even 7) while working on initial configurations. Example: Debug = 5 tr_https The tr_https section controls where stunnel listens for incoming HTTPS requests and determines the port on which the transactions are forwarded to Trevance. The defaults are as follows: [tr_https] accept = 8004 connect = :10004 TIMEOUTclose = 70 The default settings expect incoming HTTPS transactions on port 8004 and will forward the requests via HTTP to a Trevance listening on port The TIMEOUTclose setting determine the number of seconds to wait for a response. Processor Specific Settings The stunnel.conf file contains sections for each payment processor s test and production URLs. By default all the sections are enabled. You can leave them enabled or comment out the sections you do not use. Please refer to the following processor-specific sections for details. Auric Systems International is a Validated PCI Level 1 Service Provider Page 5 of 6

6 Outbound Connectivity to Payment Processor Trevance Configuration The Chase Paymentech configuration is shown above. The configuration is similar for all Trevance supported payment processors. Configure the Trevance Socket IP settings as follows: Socket IP: Port: Socket 2 IP: Port stunnel Configuration You must edit the stunnel.conf file to enter the IP and Ports provided by your payment proecssor for your installation. Edit the stunnel.conf file and locate the tr_01_out and tr_02_out sections. Change the connect entries to the processorsupplied settings. Restart stunnel when done. Auric Systems International is a Validated PCI Level 1 Service Provider Page 6 of 6