Avaya Callback Assist Application Notes for SSL or TLS Configuration

Transcription

1 Avaya Callback Assist Application Notes for SSL or TLS Configuration Release December 2017

2 Avaya Inc. All Rights Reserved. Notice While reasonable efforts have been made to ensure that the information in this document is complete and accurate at the time of printing, Avaya assumes no liability for any errors. Avaya reserves the right to make changes and corrections to the information in this document without the obligation to notify any person or organization of such changes. Documentation disclaimer Documentation means information published by Avaya in varying mediums which may include product information, operating instructions and performance specifications that Avaya may generally make available to users of its products and Hosted Services. Documentation does not include marketing materials. Avaya shall not be responsible for any modifications, additions, or deletions to the original published version of documentation unless such modifications, additions, or deletions were performed by Avaya. End User agrees to indemnify and hold harmless Avaya, Avaya's agents, servants and employees against all claims, lawsuits, demands and judgments arising out of, or in connection with, subsequent modifications, additions or deletions to this documentation, to the extent made by End User. Link disclaimer Avaya is not responsible for the contents or reliability of any linked websites referenced within this site or documentation provided by Avaya. Avaya is not responsible for the accuracy of any information, statement or content provided on these sites and does not necessarily endorse the products, services, or information described or offered within them. Avaya does not guarantee that these links will work all the time and has no control over the availability of the linked pages. Warranty Avaya provides a limited warranty on Avaya hardware and software. Refer to your sales agreement to establish the terms of the limited warranty. In addition, Avaya s standard warranty language, as well as information regarding support for this product while under warranty is available to Avaya customers and other parties through the Avaya Support website: or such successor site as designated by Avaya. Please note that if You acquired the product(s) from an authorized Avaya Channel Partner outside of the United States and Canada, the warranty is provided to You by said Avaya Channel Partner and not by Avaya. Licenses THE SOFTWARE LICENSE TERMS AVAILABLE ON THE AVAYA WEBSITE, OR SUCH SUCCESSOR SITE AS DESIGNATED BY AVAYA, ARE APPLICABLE TO ANYONE WHO DOWNLOADS, USES AND/OR INSTALLS AVAYA SOFTWARE, PURCHASED FROM AVAYA INC., ANY AVAYA AFFILIATE, OR AN AVAYA CHANNEL PARTNER (AS APPLICABLE) UNDER A COMMERCIAL AGREEMENT WITH AVAYA OR AN AVAYA CHANNEL PARTNER. UNLESS OTHERWISE AGREED TO BY AVAYA IN WRITING, AVAYA DOES NOT EXTEND THIS LICENSE IF THE SOFTWARE WAS OBTAINED FROM ANYONE OTHER THAN AVAYA, AN AVAYA AFFILIATE OR AN AVAYA CHANNEL PARTNER; AVAYA RESERVES THE RIGHT TO TAKE LEGAL ACTION AGAINST YOU AND ANYONE ELSE USING OR SELLING THE SOFTWARE WITHOUT A LICENSE. BY INSTALLING, DOWNLOADING OR USING THE SOFTWARE, OR AUTHORIZING OTHERS TO DO SO, YOU, ON BEHALF OF YOURSELF AND THE ENTITY FOR WHOM YOU ARE INSTALLING, DOWNLOADING OR USING THE SOFTWARE (HEREINAFTER REFERRED TO INTERCHANGEABLY AS YOU AND END USER ), AGREE TO THESE TERMS AND CONDITIONS AND CREATE A BINDING CONTRACT BETWEEN YOU AND AVAYA INC. OR THE APPLICABLE AVAYA AFFILIATE ( AVAYA ). Avaya grants You a license within the scope of the license types described below, with the exception of Heritage Nortel Software, for which the scope of the license is detailed below. Where the order documentation does not expressly identify a license type, the applicable license will be a Designated System License. The applicable number of licenses and units of capacity for which the license is granted will be one (1), unless a different number of licenses or units of capacity is specified in the documentation or other materials available to You. Software means computer programs in object code, provided by Avaya or an Avaya Channel Partner, whether as stand-alone products, pre-installed on hardware products, and any upgrades, updates, patches, bug fixes, or modified versions thereto. Designated Processor means a single stand-alone computing device. Server means a Designated Processor that hosts a software application to be accessed by multiple users. Instance means a single copy of the Software executing at a particular time: (i) on one physical machine; or (ii) on one deployed software virtual machine ( VM ) or similar deployment. License type(s) Designated System(s) License (DS). End User may install and use each copy or an Instance of the Software only on a number of Designated Processors up to the number indicated in the order. Avaya may require the Designated Processor(s) to be identified in the order by type, serial number, feature key, Instance, location or other specific designation, or to be provided by End User to Avaya through electronic means established by Avaya specifically for this purpose. Copyright Except where expressly stated otherwise, no use should be made of materials on this site, the Documentation, Software, Hosted Service, or hardware provided by Avaya. All content on this site, the documentation, Hosted Service, and the product provided by Avaya including the selection, arrangement and design of the content is owned either by Avaya or its licensors and is protected by copyright and other intellectual property laws including the sui generis rights relating to the protection of databases. You may not modify, copy, reproduce, republish, upload, post, transmit or distribute in any way any content, in whole or in part, including any code and software unless expressly authorized by Avaya. Unauthorized reproduction, transmission, dissemination, storage, and or use without the express written consent of Avaya can be a criminal, as well as a civil offense under the applicable law. Third Party Components Third Party Components mean certain software programs or portions thereof included in the Software or Hosted Service may contain software (including open source software) distributed under third party agreements ( Third Party Components ), which contain terms regarding the rights to use certain portions of the Software ( Third Party Terms ). As required, information regarding distributed Linux OS source code (for those products that have distributed Linux OS source code) and identifying the copyright holders of the Third Party Components and the Third Party Terms that apply is available in the products, Documentation or on Avaya s website at: or such successor site as designated by Avaya. You agree to the Third Party Terms for any such Third Party Components. THIS PRODUCT IS LICENSED UNDER THE AVC PATENT PORTFOLIO LICENSE FOR THE PERSONAL USE OF A CONSUMER OR OTHER USES IN WHICH IT DOES NOT RECEIVE REMUNERATION TO (i) ENCODE VIDEO IN COMPLIANCE WITH THE AVC STANDARD ( AVC VIDEO ) AND/OR (ii) DECODE AVC VIDEO THAT WAS ENCODED BY Callback Assist Application Notes for SSL or TLS Configuration December

3 A CONSUMER ENGAGED IN A PERSONAL ACTIVITY AND/OR WAS OBTAINED FROM A VIDEO PROVIDER LICENSED TO PROVIDE AVC VIDEO. NO LICENSE IS GRANTED OR SHALL BE IMPLIED FOR ANY OTHER USE. ADDITIONAL INFORMATION MAY BE OBTAINED FROM MPEG LA, L.L.C. SEE Note to Service Provider The product or Hosted Service may use Third Party Components subject to Third Party Terms that do not allow hosting and require a Service Provider to be independently licensed for such purpose. It is your responsibility to obtain such licensing. Preventing Toll Fraud Toll Fraud is the unauthorized use of your telecommunications system by an unauthorized party (for example, a person who is not a corporate employee, agent, subcontractor, or is not working on your company's behalf). Be aware that there can be a risk of Toll Fraud associated with your system and that, if Toll Fraud occurs, it can result in substantial additional charges for your telecommunications services. Avaya Toll Fraud intervention If You suspect that You are being victimized by Toll Fraud and You need technical assistance or support, call Technical Service Center Toll Fraud Intervention Hotline at for the United States and Canada. For additional support telephone numbers, see the Avaya Support website: or such successor site as designated by Avaya. Suspected security vulnerabilities with Avaya products should be reported to Avaya by sending mail to: securityalerts@avaya.com. Downloading Documentation For the most current versions of Documentation, see the Avaya Support website: or such successor site as designated by Avaya. Contact Avaya Support See the Avaya Support website: for product or Hosted Service notices and articles, or to report a problem with your Avaya product or Hosted Service. For a list of support telephone numbers and contact addresses, go to the Avaya Support website: (or such successor site as designated by Avaya), scroll to the bottom of the page, and select Contact Avaya Support. Trademarks The trademarks, logos and service marks ( Marks ) displayed in this site, the Documentation, Hosted Service(s), and product(s) provided by Avaya are the registered or unregistered Marks of Avaya, its affiliates, or other third parties. Users are not permitted to use such Marks without prior written consent from Avaya or such third party which may own the Mark. Nothing contained in this site, the Documentation, Hosted Service(s) and product(s) should be construed as granting, by implication, estoppel, or otherwise, any license or right in and to the Marks without the express written permission of Avaya or the applicable third party. Avaya is a registered trademark of Avaya Inc. All non-avaya trademarks are the property of their respective owners. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries. Callback Assist Application Notes for SSL or TLS Configuration December

4 Table of Contents Table of Contents Introduction... 6 Prerequisites... 6 Protocols... 6 Disable TLSv1 and TLSv1.1 Protocols... 6 Configuration procedure... 7 Keystore and Certificates... 7 Importing an existing certificate to keystore... 7 Creating a new keystore with self-signed certificate... 9 Exporting certificate file from keystore Configuring SSL for the web administration application Configuring SSL for Dialogs Configuring Avaya Aura Experience Portal Configuring OD applications Configuring SSL for Web services WSDL document location Pending Callbacks Summary Report Configuring SSL for File Server (Riak) Prerequisites Configuring an existing certificate to Riak Create a Self-signed certificate for Riak Additional Configurations (Optional) Using Riak Utilities on SSL Configuring TLS for BSR polling Setting up TLS on CBA BSR Setting up TLS on Session Manager Setting up certificates Downloading and importing SM certificate to CBA JVM Exporting CBA BSR certificate Callback Assist Application Notes for SSL or TLS Configuration December

5 Table of Contents Importing CBA BSR certificate through SMGR Restarting BSR Component Checking polling status Tomcat s security vulnerability [Optional] OPTIONS method enabled Glossary Callback Assist Application Notes for SSL or TLS Configuration December

6 Introduction Introduction The Avaya Callback Assist Application Notes for SSL or TLS Configuration provides description of the procedure required for configuring HTTPS support for Administration, Dialogs, and Web Services Tomcat instances. This also describes the steps required to configure SSL/TLS for the File Server (Riak) and TLS configuration for BSR Polling. The Administration, Dialogs, and Web Services applications are deployed on individual Tomcat servers under the Callback Assist installation folder. The following table shows the applications, the name of the corresponding Tomcat instances, and the http ports used: Application Name Tomcat Server names http port Administration apache-tomcat-adminapp 80 Dialogs apache-tomcat-ddapps 8080 Web Services apache-tomcatwebcallback 8081 Prerequisites Callback Assist software is already installed. The following table shows the tomcat instances and the corresponding ports which are used for enabling SSL. Ensure that the ports are free on the system where Callback Assist is installed. Tomcat instance https port apache-tomcat-adminapp 443 apache-tomcat-ddapps 8444 apache-tomcat-webcallback 8446 In this document the command line examples of Java Home directory is referred from /opt/avaya/jdk directory. Assuming Java (JDK/JRE) is installed in this path. Protocols The Tomcat instances used in Callback assist use JSSE as underlying SSL library. The Supported protocol versions are SSLv2, SSLv3, TLSv1, TLSv1.1 and TLSv1.2. Note that SSLv2 and SSLv3 are inherently unsafe and TLSv1 and TLSv1.1 are weak protocols. Disable TLSv1 and TLSv1.1 Protocols This section guides you to disable TLSv1 and TLSv1.1 protocols and enforce all the Java client and server components to use only TLSv1.2 as a communication protocol. Change java.security file to disable TLSv1 and TLSv1.1 protocols: Callback Assist Application Notes for SSL or TLS Configuration December

7 Keystore and Certificates 1. Go to JRE security folder by navigating Java 8 Installation Path: <JAVA_INSTALLATION_PATH>/jre<VERSION>/lib/security 2. Edit the java.security file and change the jdk.tls.disabledalgorithms property to include TLS protocols: jdk.tls.disabledalgorithms=sslv3, RC4, MD5withRSA, DH keysize < 768, \ EC keysize < 224, TLSv1, TLSv1.1 Follow the Oracle Java guide to disable weak ciphers: Algorithms Note: This step is not required if you are planning to use either TLSv1 or TLSv1.1. Configuration procedure This guide uses a single certificate file for configuring all the three Tomcat instances. Create a new folder inside the Callback Assist installation folder to place the keystore file: 1. Navigate to the Callback Assist installation folder: cd /opt/avaya/callbackassist 2. Create a new folder with folder name ssl: mkdir ssl Keystore and Certificates A keystore file with certificate is required to configure https. If a certificate is already available, then import the certificate into the keystore file. If you do not have a certificate, then you can generate a selfsigned certificate and use. Importing an existing certificate to keystore 1. Copy the certificate file and the key file to the following path: /opt/avaya/callbackassist/ssl 2. Convert both the files into a single PKCS12 file: openssl pkcs12 -export -in /opt/avaya/callbackassist/ssl/callback.crt -inkey /opt/avaya/callbackassist/ssl/callback.key > /opt/avaya/callbackassist/ssl/callback.p12 3. Navigate to the Java bin folder: cd <JAVA_INSTALLATION_DIR>/bin 4. Import the certificate into keystore: Callback Assist Application Notes for SSL or TLS Configuration December

8 Keystore and Certificates./keytool -importkeystore -srckeystore /opt/avaya/callbackassist/ssl/callback.p12 -destkeystore /opt/avaya/callbackassist/ssl/keystore.jks -srcstoretype pkcs12 5. Enter the source and destination keystore passwords. 6. Change the alias name to callback:./keytool -keystore /opt/avaya/callbackassist/ssl/keystore.jks - changealias -alias 1 -destalias callback [root@rhel60epaep ssl]# openssl pkcs12 -export -in /opt/avaya/callbackassist/ssl/callback.crt -inkey /opt/avaya/callbackassist/ssl/callback.key > /opt/avaya/callbackassist/ssl/callback.p12 Enter Export Password: Verifying - Enter Export Password: [root@rhel60epaep ssl]# cd /opt/avaya/jdk/bin [root@rhel60epaep bin]#./keytool -importkeystore -srckeystore /opt/avaya/callbackassist/ssl/callback.p12 -destkeystore /opt/avaya/callbackassist/ssl/keystore.jks -srcstoretype pkcs12 Enter destination keystore password: Re-enter new password: Enter source keystore password: Entry for alias 1 successfully imported. Import command completed: 1 entries successfully imported, 0 entries failed or cancelled [root@rhel60epaep ssl]#./keytool -keystore /opt/avaya/callbackassist/ssl/keystore.jks -changealias -alias 1 -destalias callback Enter keystore password: [root@rhel60epaep ssl]# Callback Assist Application Notes for SSL or TLS Configuration December

9 Keystore and Certificates Creating a new keystore with self-signed certificate To create a new keystore that contains a single self-signed certificate, run the following from the terminal command line: 1. Navigate to the Java bin folder. cd <JAVA_INSTALLATION_DIR>/bin 2. Run the command./keytool -genkey -alias callback -keyalg RSA -keystore /opt/avaya/callbackassist/ssl/keystore.jks Note: The cert generation must pass customer security requirements so the command may change. After you run the command, the system prompts you for the keystore password. The default password used by Tomcat is "changeit" (all lower case), although you can specify a custom password if you want. You also need to specify the custom password in the server.xml configuration file, as described later. Next, the system prompts you for general information about this certificate, such as hostname (CN), organizational unit (OU), organization (O), and so on. This information will be displayed to the users who attempt to access a secure page in your application, thus making sure that the information provided here matches what they will expect. Note: it is recommended to always use the FQDN of the host as CN while creating the certificates (question What is your first and last name?). In some cases the client connecting to CBA ignores this validation and connects to the host with warning messages. But in other cases, such as MPP Linux machines, it performs the hostname validation strictly. So it is best to create new certificates with valid CN. Finally, the system prompts you for the key password, which is the password specific to this certificate, and different from the passwords for other certificates stored in the same keystore file. You must use the same password here that you used for the keystore password. This is a restriction of the Tomcat implementation. At present, the keytool prompt indicates that pressing the ENTER key automatically enters the key password for you. After successful completion of all the procedures, the system creates a keystore file with a certificate that can be used by your server in the path /opt/avaya/callbackassist/ssl. [root@rhel60epaep 4.1.6]# cd /opt/avaya/callbackassist [root@rhel60epaep callbackassist]# mkdir ssl [root@rhel60epaep callbackassist]# cd /opt/avaya/jdk/bin [root@rhel60epaep bin]#./keytool -genkey -alias callback -keyalg RSA -keystore /opt/avaya/callbackassist/ssl/keystore.jks Enter keystore password: Callback Assist Application Notes for SSL or TLS Configuration December

10 Keystore and Certificates Re-enter new password: What is your first and last name? [Unknown]: server205.avayacba.com What is the name of your organizational unit? [Unknown]: aps What is the name of your organization? [Unknown]: avaya What is the name of your City or Locality? [Unknown]: chennai What is the name of your State or Province? [Unknown]: TN What is the two-letter country code for this unit? [Unknown]: IN Is CN=server205.avayacba.com, OU=aps, O=avaya, L=chennai, ST=TN, C=IN correct? [no]: yes Enter key password for <callback> (RETURN if same as keystore password): bin]# Exporting certificate file from keystore 1. Navigate to the Java bin folder: cd <JAVA_INSTALLATION_DIR>/bin 2. Run the keytool command:./keytool -export -keystore /opt/avaya/callbackassist/ssl/keystore.jks -alias callback -file /opt/avaya/callbackassist/ssl/callback.cer 3. Enter the keystore password. 4. The certificate file is created under the path: /opt/avaya/callbackassist/ssl bin]# cd /opt/avaya/jdk/bin bin]#./keytool -export -keystore /opt/avaya/callbackassist/ssl/keystore.jks -alias callback -file /opt/avaya/callbackassist/ssl/callback.cer Enter keystore password: Certificate stored in file </opt/avaya/callbackassist/ssl/callback.cer> bin]# Callback Assist Application Notes for SSL or TLS Configuration December

11 Configuring SSL for the web administration application Configuring SSL for the web administration application 1. Stop the Callback Assist administration application server: /sbin/service tomcat-adminapp stop 2. Navigate to the config folder of the administration Tomcat instance: cd /opt/avaya/callbackassist/apache-tomcat-adminapp/conf 3. Edit the server.xml file: vi server.xml 4. Comment the connector with port 80 to prevent http access of the application. 5. Uncomment the connector with port 8443 and add the following attributes. a. port="443" b. keystorefile="/opt/avaya/callbackassist/ssl/keystore.jks" c. keystorepass="changeit" d. keyalias="callback" e. server= Admin App 6. [OPTIONAL] By default Java 8 uses TLSv1.2 protocol; the following attribute changes are required only if you want to enforce to use TLSv1 or TLSv1.1. Make sure the steps Disable TLSv1 and TLSv1.1 protocols are not followed before. sslenabledprotocols="tlsv1,tlsv1.1" 7. Change the redirect port to 443. <Connector port="8011" protocol="ajp/1.3" redirectport="443" /> 8. After the changes, the connectors should look as follows (SSL Protocol): <Connector port="8011" protocol="ajp/1.3" redirectport="443" /> <!-- <Connector port="80" protocol="http/1.1" connectiontimeout="20000" redirectport="8443" />--> <!-- A "Connector" using the shared thread pool--> <!-- <Connector executor="tomcatthreadpool" port="8080" protocol="http/1.1" connectiontimeout="20000" redirectport="8443" /> --> <!-- Define a SSL HTTP/1.1 Connector on port 8443 This connector uses the JSSE configuration, when using APR, the connector should be using the OpenSSL style configuration described in the APR documentation --> Callback Assist Application Notes for SSL or TLS Configuration December

12 Configuring SSL for the web administration application <Connector port="443" protocol="http/1.1" scheme="https" secure="true" SSLEnabled="true" connectiontimeout="20000" keystorefile="/opt/avaya/callbackassist/ssl/keystore.jks" keystorepass="changeit" keyalias="callback" clientauth="false" sslprotocol="tls" server= Admin App /> 9. Save the changes and start the Tomcat server: /sbin/service tomcat-adminapp start The administration application is now accessible through the following URL: Callback Assist Application Notes for SSL or TLS Configuration December

13 Configuring SSL for Dialogs Configuring SSL for Dialogs The following procedure configures SSL for the OD modules. 1. Stop the Dialogs Tomcat server : /sbin/service tomcat-ddapps stop 2. Navigate to the config folder of the dialogs tomcat instance: cd /opt/avaya/callbackassist/apache-tomcat-ddapps/conf 3. Edit the server.xml file vi server.xml 4. Comment the connector with port 8080 to prevent http access of the applications. 5. Uncomment the connector with port 8443 and add the following attributes. a. port="8444" b. connectiontimeout="20000" c. keystorefile="/opt/avaya/callbackassist/ssl/keystore.jks" d. keystorepass="changeit" e. keyalias="callback f. server= DD App 6. [OPTIONAL] By default Java 8 uses TLSv1.2 protocol; the following attribute changes are required only if you want to enforce to use TLSv1 or TLSv1.1. Make sure the steps Disable TLSv1 and TLSv1.1 protocols are not followed before. sslenabledprotocols="tlsv1,tlsv1.1" 7. Change the redirect port to <Connector port="8012" protocol="ajp/1.3" redirectport="8444" /> 8. After the changes, the connectors in server.xml should look as follows: <Connector port="8012" protocol="ajp/1.3" redirectport="8444" /> <!-- <Connector port="8080" protocol="http/1.1" connectiontimeout="20000" redirectport="8443" />--> <!-- A "Connector" using the shared thread pool--> <!-- <Connector executor="tomcatthreadpool" port="8080" protocol="http/1.1" connectiontimeout="20000" redirectport="8443" /> --> <!-- Define a SSL HTTP/1.1 Connector on port 8443 This connector uses the JSSE configuration, when using APR, the connector should be using the OpenSSL style configuration Callback Assist Application Notes for SSL or TLS Configuration December

14 Configuring SSL for Dialogs described in the APR documentation --> <Connector port="8444" protocol="http/1.1" scheme="https" secure="true" SSLEnabled="true" connectiontimeout="20000" keystorefile="/opt/avaya/callbackassist/ssl/keystore.jks" keystorepass="changeit" keyalias="callback" clientauth="false" sslprotocol="tls" server= DD App /> 9. Save the changes and start the Tomcat server: /sbin/service tomcat-ddapps start Configuring Avaya Aura Experience Portal You must add the certificate file to the trusted certificates list of the Experience Portal for enabling the https access of the dialogs from VoicePortal. 1. On the Web browser, enter the Experience Portal EPM Administration URL: 2. In the User Name field, enter the user name. 3. Click Submit. 4. In the Password field, enter the password. 5. Click Logon. 6. Click Security> Certificates. 7. Click on the Trusted Certificates tab. 8. Enter name as callback. 9. Select the Type as application. 10. Click the browse button and upload the callback.cer certificate file. 11. Click continue. 12. Click save. After a successful upload, the screen looks as follows: Callback Assist Application Notes for SSL or TLS Configuration December

15 Configuring SSL for Dialogs Configuring OD applications Update the application section of the voice portal with new https URLs. The following table lists the http URLs and the corresponding https URLs. HTTP URL callback-application-serverhostname>:8080/cbactiagent/start ntrol or Control?EmergencyDestination=XXXXXX HTTPS URL callback-application-serverhostname >:8444/CBACTIAgent/Start ntrol or Control?EmergencyDestination=XXXXXX Callback Assist Application Notes for SSL or TLS Configuration December

16 Configuring SSL for Web services Configuring SSL for Web services The following procedure configures SSL for the Webcallback Webservice. 1. Stop the WebCallback application server: /sbin/service tomcat-webcallback stop 2. Navigate to the config folder of the webcallback tomcat instance: cd /opt/avaya/callbackassist/apache-tomcat-webcallback/conf 3. Edit the server.xml file vi server.xml 4. Comment the connector with port 8081 to prevent http access of the application. 5. Uncomment the connector with port 8443 and add the following attributes. a. port="8446" b. keystorefile="/opt/avaya/callbackassist/ssl/keystore.jks" c. keystorepass="changeit" d. connectiontimeout="20000" e. keyalias="callback" f. server= Web Callback 6. [OPTIONAL] By default Java 8 uses TLSv1.2 protocol; the following attribute changes are required only if you want to enforce to use TLSv1 or TLSv1.1. Make sure the steps Disable TLSv1 and TLSv1.1 protocols are not followed before. sslenabledprotocols="tlsv1,tlsv1.1" 7. Change the redirect port to <Connector port="8013" protocol="ajp/1.3" redirectport="8446" /> 8. After the changes, the connectors in server.xml should look as follows: <Connector port="8013" protocol="ajp/1.3" redirectport="8446" /> <!--<Connector port="8081" protocol="http/1.1" connectiontimeout="20000" redirectport="8443" /> --> <!-- A "Connector" using the shared thread pool--> <!-- <Connector executor="tomcatthreadpool" port="8080" protocol="http/1.1" connectiontimeout="20000" redirectport="8443" /> --> <!-- Define a SSL HTTP/1.1 Connector on port 8443 This connector uses the JSSE configuration, when using APR, the Callback Assist Application Notes for SSL or TLS Configuration December

17 Configuring SSL for Web services connector should be using the OpenSSL style configuration described in the APR documentation --> <Connector port="8446" protocol="http/1.1" scheme="https" secure="true" SSLEnabled="true" connectiontimeout="20000" keystorefile="/opt/avaya/callbackassist/ssl/keystore.jks" keystorepass="changeit" keyalias="callback" clientauth="false" sslprotocol="tls" server= Web Callback /> 9. Save the changes and start the Tomcat server: /sbin/service tomcat-webcallback start WSDL document location After the SSL configuration changes, the WSDL documents are available at the following location: Release 4.0 URL: Release 4.1 URL: Pending Callbacks Summary Report Pending Callback Summary report in CBA Admin UI application gets data from the webcallback SOAP webservice. It connects to the webservice using http protocol by default. The default connection URL is If http access is disabled on apache-tomcat-webcallback, it is required to change the ca.endpoint property in <CBA Install directory>/apache-tomcat-adminapp/webapps/admin/web-inf/classes/cbawsconfig.properties file with the new URL similar to the one shown below. (Change hostname and port) ca.conn.time.out = ca.read.time.out = ca.endpoint = When SSL is configured on apache-tomcat-webcallback, the FQDN that is specified in the certificate s CN section should match with the server name. It is always recommended to use FQDN as a server name in the ca.endpoint property. Callback Assist Application Notes for SSL or TLS Configuration December

18 Configuring SSL for File Server (Riak) The security certificate of the apache-tomcat-webcallback should be added to the trusted certificates in the runtimeconfig application. Steps to add the certificate is like the steps mentioned in Add Other Application s Security Certificate to CBA section of Installing and configuring Avaya Callback Assist user guide. The URL to fetch the security certificate is apache-tomcat-adminapp tomcat instance should be restarted after adding the certificate. Configuring SSL for File Server (Riak) The following procedure configures SSL for CBA File Server component (Riak). This procedure applies only for 64 bit OS (Riak 2.x), since the file server doesn t support SSL for 32 bit OS (Riak 1.x). In this section we have used an example IP Address as and its hostname as server205.avayacba.com. Prerequisites 1. The hostname (FQDN) of the CBA Application Server should be properly configured. Make sure all the CBA Servers and MPP/EPM Servers has this hostname entry in their/etc/hosts file. 2. If self-signed certificate will be used, then the Linux OS should have openssl tool to generate a new certificate. 3. Basic knowledge on SSL and Linux commands. 4. The CN (Common Name) section of the subject (in the certificate) must match the FQDN of the server, or the certificate verification will fail. Configuring an existing certificate to Riak You need 3 certificate related files (Root CA Certificate, Certificate file, Key file) in order to proceed further. If you don t have one, follow the steps mentioned in section Create a self-signed certificate for Riak. 1. Create a directory ssl (if doesn t exists ) under callbackassist installation folder and navigate to the directory. cd /opt/avaya/callbackassist/ssl 2. Create a new folder called fileserver-certs mkdir fileserver-certs 3. Copy the certificate files to the directory fileserver-certs. The following files are required to configure SSL. a. Certificate file b. Key file c. Root CA Certificate file (Signing authority) Callback Assist Application Notes for SSL or TLS Configuration December

19 Configuring SSL for File Server (Riak) 4. Configure the above certificate files in riak configuration file: /opt/avaya/callbackassist/file-server/etc/riak.conf 5. Edit the riak configuration file and modify the following properties (uncomment the properties by removing ## symbol in-front of each line). ssl.certfile = /opt/avaya/callbackassist/ssl/fileserver-certs/riaknode.crt ssl.keyfile = /opt/avaya/callbackassist/ssl/fileserver-certs/riaknode.key ssl.cacertfile = /opt/avaya/callbackassist/ssl/fileserver-certs/rootca.crt 6. Enable https access by changing the following configuration (uncomment the properties by removing ## symbol in-front of each line). The following configuration would establish SSL connection on port 8098 in server (The IP Address of CBA server will be already in place during the installation of CBA itself so there is no need to change it). Example. listener.https.internal = : Disable http access (comment the below configuration by adding ## symbol in-front of the configuration). Example: ## listener.http.internal = : Go to CBA Administration page > Global Settings > Audio, change the Storage URL value to https. If the server uses IP Address, change to hostname Repeat the above steps for all the CBA Application s Riak Nodes (applicable only for HA deployment). 10. Follow the steps Add Riak File Server Certificate to CBA to import the file server(s) certificate to CBA. For every riak configuration change the riak node should be restarted in order to take the changes effect. This will be done at the end of this step by restarting entire callbackassist service. Callback Assist Application Notes for SSL or TLS Configuration December

20 Configuring SSL for File Server (Riak) Adding Riak File Server Certificate to CBA Other CBA components needs to access Riak file server as a client. So the Riak Node s certificate needs to be added to the CBA trust store. CBA uses the OD runtimeconfig application to manage these certificates. The default keystore file path in the runtimeconfig web application should not be changed. Follow the steps below to add the certificates. 1. Open Avaya Orchestration Designer runtimeconfig application (deployed in Dialogs tomcat) in a browser by entering the below URL. If SSL is enabled for Dialogs module change the port and protocol accordingly Login with default username (ddadmin) and password (ddadmin). 3. In the Avaya Orchestration Designer runtimeconfig application, click on the Certificates link on the left navigation pane. Callback Assist Application Notes for SSL or TLS Configuration December

21 Configuring SSL for File Server (Riak) 4. Click on the Fetch button and enter the URL HOSTNAME>:8098/riak in the Location field with a valid name and click continue. 5. If the server s certificate is not imported using Fetch button you can install the certificate manually by using the Add button. 6. The new certificate gets displayed in the Certificates page. Click the Save button at the bottom of the page to permanently add the certificate to the keystore file 7. Repeat the above steps for all the CBA Application s Riak Nodes (applicable only for HA deployment). 8. Restart Callback Assist service for the new certificate(s) to take effect. Callback Assist Application Notes for SSL or TLS Configuration December

22 Configuring SSL for File Server (Riak) Create a Self-signed certificate for Riak 1. Create a directory ssl (if doesn t exists ) under callbackassist installation folder and navigate to the directory. cd /opt/avaya/callbackassist/ssl 2. Create a new folder called fileserver-certs mkdir fileserver-certs 3. Generate Root CA key by using RSA algorithm with the key length of 2048 openssl genrsa -out rootca.key Create CSR file for Root CA key with the below subject. You can change the content of the subject line as per the requirement. openssl req -new -key rootca.key -out rootca.csr -subj "/C=IN/ST=TN/L=Chennai/O=Avaya/OU=EPNT/CN=RootCA/ Address=noreply@avaya.com " 5. Using self-signed Root CA CSR and Generate a Root CA Certificate openssl x509 -req -days 365 -in rootca.csr -signkey rootca.key -out rootca.crt 6. Generate a Key file for Riak Node by using RSA algorithm with the key length of 2048 openssl genrsa -out riaknode.key Generate a CSR file for Riak Node. You must change the hostname of the Riak Node in the CN section of the subject in the openssl command below. The other parameters can be changed as per the requirement. openssl req -new -key riaknode.key -out riaknode.csr -subj "/C=PH/ST=PH/L=PH/O=Avaya/OU=CliServ/CN=server205.avayacba.com/ Address=nor eply@avaya.com" 8. Sign the CSR with Root CA and Generate Certificate for Riak Node openssl x509 -req -days 365 -in riaknode.csr -CA rootca.crt -CAkey rootca.key - CAcreateserial -out riaknode.crt 9. The following certificate files are created in the current folder. riaknode.crt riaknode.csr riaknode.key rootca.crt Callback Assist Application Notes for SSL or TLS Configuration December

23 Configuring SSL for File Server (Riak) rootca.csr rootca.key rootca.srl 10. Keep only the following files and remove the other files. rootca.crt (Root CA Certificate file (Signing authority)) riaknode.key (Certificate Key file) riaknode.crt (Certificate file) 11. Now follow the steps Configuring an existing certificate to Riak to configure SSL for Riak. Callback Assist Application Notes for SSL or TLS Configuration December

24 Configuring SSL for File Server (Riak) Additional Configurations (Optional) 1. When using Riak security, you can choose which versions of SSL/TLS are allowed. By default, only TLS 1.2 is allowed, but this version can be disabled and others enabled by setting the following configurable parameters to on or off via riak.conf file. tls_protocols.tlsv1 tls_protocols.tlsv1.1 tls_protocols.tlsv1.2 tls_protocols.sslv3 2. Whether to check the certificate revocation list (CRL) of a client certificate. This defaults to on but some CAs may not maintain or define a CRL, so this can be disabled if no CRL is available. check_crl = off 3. Whether to prefer the order in which the server lists its ciphers. When set to off, the client's preferred cipher order dictates which cipher is chosen. honor_cipher_order = off Using Riak Utilities on SSL When Riak file server is running on SSL, the riak utilities (RiakFileCheck.jar, RiakUploadUtility.jar) can be used by providing the path of the truststore and its password. This can be done by the following Java commands. 1. Navigate to riak-utility folder of CBA installation. cd /opt/avaya/callbackassist/support/riak-utility 2. Specify the truststore file location and its password as a command line Java VM arguments (- Djavax.net.ssl.trustStorePassword, -Djavax.net.ssl.trustStore) followed by the required program arguments (FileServer Hostname, Database Server IP). /opt/avaya/jdk/bin/java - Djavax.net.ssl.trustStore=/opt/Avaya/callbackassist/apache-tomcatddapps/lib/trusted_weblm_certs.jks -Djavax.net.ssl.trustStorePassword=password -jar RiakFileCheck.jar server205.avayacba.com Note: The file server should be referenced by its hostname only, otherwise it will throw CertificateException (javax.net.ssl.sslhandshakeexception: java.security.cert.certificateexception: No subject alternative names present). Callback Assist Application Notes for SSL or TLS Configuration December

25 Configuring SSL for File Server (Riak) RiakUploadUtility.jar can also be run on the same way by specifying the Java VM arguments followed by program arguments. /opt/avaya/jdk/bin/java -Djavax.net.ssl.trustStore=/opt/Avaya/callbackassist/apachetomcat-ddapps/lib/trusted_weblm_certs.jks -Djavax.net.ssl.trustStorePassword=password -jar RiakUploadUtility.jar server205.avayacba.com deliverycustomermenumessageid /opt/avaya/callbackassist/apache-tomcatddapps/webapps/cbaphrases/samples/englishus/enus/default/example_cf_menu_with_reschedule.wav example_cf_menu_with_reschedule.wav Callback Assist Application Notes for SSL or TLS Configuration December

26 Configuring TLS for BSR polling Configuring TLS for BSR polling This section describes the steps required to set up Callback Assist and Session Manager to use TLS for SIP BSR polling. The focus is on setting up TLS, assuming all other required configuration are in place and CBA s BSR Polling is already configured and working fine with TCP. Setting up TLS on CBA BSR Open CBA Admin UI and go to BSR Configuration, select Service Controller Callback Assist Application Notes for SSL or TLS Configuration December

27 Configuring TLS for BSR polling Locate Polling Service and click Configuration Select Configure next to Polling Connector Callback Assist Application Notes for SSL or TLS Configuration December

28 Configuring TLS for BSR polling Select Configure next to SIP Proxy Set SIP Proxy Port as 5061 Set Transport Protocol as tls Set/leave User/Password as bsr/bsr Click Save Callback Assist Application Notes for SSL or TLS Configuration December

29 Configuring TLS for BSR polling Setting up TLS on Session Manager Open System Manager Web UI and select Elements -> Routing Select Entity Links and click the entity link name defined from your CBA BSR Callback Assist Application Notes for SSL or TLS Configuration December

30 Configuring TLS for BSR polling Set Protocol to TLS Set Port for SIP Entity 1 (SM) to 5061 Set Port for SIP Entity 2 (CBA) to Set Connection Policy to Trusted Click Commit Setting up certificates Downloading and importing SM certificate to CBA JVM This step is required only if the Session Manager is not using certificate signed by a trusted CA, e.g. when using Avaya demo certificate. Connect to CBA box via SSH Create a new directory called cert in CBA installation directory (/opt/avaya/callbackassist by default) Run the following command to retrieve certificate used for SIP communication by Session Manager openssl s_client -connect <IP of SM>:5061 2>/dev/null openssl x509 >AvayaSipCA.pem Where <IP of SM> has to be replaced by the actual IP address of the SM (SIP proxy) BSR is connecting to. Import the certificate file into the keystore of the JVM used by CBA keytool -importcert -alias SessMgr -keystore <JAVA_INSTALLATION_DIR>/jre/lib/security/cacerts - storepass changeit -file AvayaSipCA.pem In case keytool is not in your path, you can find it under <JAVA_INSTALLATION_DIR> /bin Answer yes when asked whether to trust this certificate Callback Assist Application Notes for SSL or TLS Configuration December

31 Configuring TLS for BSR polling Trust this certificate? [no]: yes Certificate was added to keystore In case of a HA setup, repeat the above steps for secondary CBA server hosting BSR In case you have failover SIP proxies configured in CBA, repeat the above steps for those as well. Exporting CBA BSR certificate Log in to (primary) CBA server hosting the BSR component via SSH using root user Run the following command to export the certificate: keytool -export -alias icrsippolling -file cbabsr.crt -keystore /opt/avaya/callbackassist/bsr-server/conf/.keystore_icrsippolling Enter keystore password oa1se0nti when prompted for it Download the certificate (cbabsr.crt) using WinSCP or similar SCP tool Importing CBA BSR certificate through SMGR Open System Manager Web UI Go to Services -> Inventory -> Manage Elements Callback Assist Application Notes for SSL or TLS Configuration December

32 Configuring TLS for BSR polling Callback Assist Application Notes for SSL or TLS Configuration December

33 Configuring TLS for BSR polling Select your Session Manager and click More Actions -> Configure Trusted Certificates Click Add Callback Assist Application Notes for SSL or TLS Configuration December

34 Configuring TLS for BSR polling Select Store type as SECURITY_MODULE_SIP Browse the.crt file retrieved from CBA server Click Retrieve Certificate Click Commit Verify if the certificate appears in the list of trusted certificates Restarting BSR Component Restart BSR component on CBA server(s), run the following commands on CBA via SSH: ~]# service cba-bsrserver stop Stopping CBA BSR Server service... [ OK ] [root@cba44 ~]# service cba-bsrserver start Starting CBA BSR Server service... [ OK ] Callback Assist Application Notes for SSL or TLS Configuration December

35 Configuring TLS for BSR polling Checking polling status To check if TLS connection is working properly, perform the following steps: Open CBA Admin UI and go to BSR Configuration, select Call Center Application Status Status shall be indicated as Running and Open for all your skills Callback Assist Application Notes for SSL or TLS Configuration December

36 Glossary Tomcat s security vulnerability [Optional] This section guides you to configure few things to avoid few security vulnerabilities. OPTIONS method enabled By default tomcat supports all available HTTP methods. This can be changed by the configuration to disable specific http-methods. This vulnerability can be resolved by enabling the following configuration in Tomcat s web.xml file. For CBA Web administration s tomcat instance web.xml file will be located in: /opt/avaya/callbackassist/apache-tomcat-adminapp/conf/web.xml Add the below XML tags to the end of the file with in </web-app> tags. <security-constraint> <web-resource-collection> <web-resource-name>restricted methods</web-resource-name> <url-pattern>/*</url-pattern> <http-method>options</http-method> </web-resource-collection> <auth-constraint /> </security-constraint> Troubleshooting after automatic TLS configuration Considering the situations you may encounter, please note that this guide is by no means exhaustive and each situation needs separate investigation. The current document contains all the steps that the installation script automates. If you find yourself in need to troubleshoot the TLS configuration, this document (especially the manual steps) contain all the steps that were taken in order to configure your system and you can validate them by hand. The following are some of the most frequent situations we encountered when configuring TLS: Installation throws errors similar to this: Please enter the address of the Session Manager you intend to use Please enter port for SIPS used by Session Manager (leave empty for 5061) Callback Assist Application Notes for SSL or TLS Configuration December

37 Glossary unable to load certificate :error:0906D06C:PEM routines:pem_read_bio:no start line:pem_lib.c:703:expecting: TRUSTED CERTIFICATE Warning: Could not import Session Manager certificate from :5061 Possible problems: - Wrong IP for SM - Wrong Port for SM - SM doesn t listen on the port specified - SM doesn t have TLS enabled Call Center Application Status is not in Running state: - Check that you imported certificate file called icrsip.crt into SMGR - Check that in Session Manager you have TLS enabled and correct port for BSR - Check that you are using the correct local port for BSR - Check that SIP Proxy uses tls as transport protocol and has the correct port When trying to leave a callback, you are prompted saying that the system is experiencing technical difficulties - Check that Experience Portal can reach your ddapps server - Check that you ve configured the proper URLs in EP with the appropriate protocol (https), FQDN and port (8444) for your CBA - Check that your tomcat.crt certificate (from all the CBA nodes) are trusted in EP - Check that your certificate CN field matches your FQDN. - Check the CXI logs to see if EP has encountered any other problems with your certificate. When installing an HA deployment, and file server tries to connect to the master application server and receives the following error (13:19:14) WARN: File Server is NOT running on host qa-ha-lab-master.luxoft.com:8098. Trying with secure connection... *** ERROR: File Server is NOT running on host qa-ha-lab-master.luxoft.com neither in HTTP nor HTTPS *** Make sure CBA File server is up and running on the given host before installing CBA. - This is a problem with curl (we experienced this with curl version ) and the problem solved itself, after we ve upgraded to You find in CBA logs a message similar to this: Server chose TLSv1, but that protocol version is not enabled or not supported by the client This means the component interacting with your CBA isn t using TLSv1.2. In this situation you have two options: Callback Assist Application Notes for SSL or TLS Configuration December

38 Glossary - Edit java.security in the Java runtime you are using for CBA, and edit the section called jdk.tls.disabledalgorithms and re-enable that specific version of TLS. Please note that this option weakens your security and we do not recommend this. - Enable TLSv1.2 in the other component CBA is communicating with. This is the recommended solution for the situation. Callback Assist Application Notes for SSL or TLS Configuration December

39 Glossary Glossary For more information, see the following: ovider Callback Assist Application Notes for SSL or TLS Configuration December