Configuring the RTP Server

Size: px

Start display at page:

Download "Configuring the RTP Server"

Laurel Wiggins
5 years ago
Views:

Configuring the RTP Server To configure the RTP Server you can click on the little cog in the lower right hand corner of the banner area at the top of the window (If the RTP Server is running you

1 Configuring the RTP Server To configure the RTP Server you can click on the little cog in the lower right hand corner of the banner area at the top of the window (If the RTP Server is running you will first need to stop the RTP Server at which point the cog will become enabled). When you click on the cog the Configure pane will slide into the main area of the window. In the Configure pane you can set up your SSL settings. You will need to identify a path to your keystore file as well as the password protecting your keystore. See the section below RTP Server and SSL for more information on how to create your keystore file.

RTP Server and SSL In order to enable SSL on the RTP Server you will need an SSL certificate. The RTP server reads an SSL certificate chain from a Java KeyStore (.

2 RTP Server and SSL In order to enable SSL on the RTP Server you will need an SSL certificate. The RTP server reads an SSL certificate chain from a Java KeyStore (.jks) file so you will need to put your certificate, private key and any required intermediate certificates in to a.jks file. To create a.jks file you can use the keytool command line application. In order to use key tool you will need to install a Java Developer Kit (JDK) from Oracle. How to setup your SSL certificate file I Already Have An SSL Certificate If you already have a valid SSL certificate from a Certifying Authority (CA) in a PKCS#12 format (either a.p12 or a.pfx file) that contains your private key, base certificate and any required intermediate certificates, you can import that chain into a.jks file using the keytool utility with the following command:

3 keytool -importkeystore -srckeystore <YourPKCS12File>.p12 \ -srcstoretype pkcs12 -destkeystore <YourJKSFile>.jks When you execute this command you will be prompted for the password to apply to your.jks file, and then again to confirm it. In our experience, for things to work properly, you will need to set the password for your.jks file to the same password you assigned to the pkcs12 file that you are importing from. Enter destination keystore password: <your.jks file password> Re-enter new password: <your.jks file password> Next you will be prompted for the password for your PKCS#12 file that your importing the certificate chain from. Enter source keystore password: <your pkcs12 file password> So now you should have a.jks file that you can use with the RTP Server. You can look at the contents of your.jks using keytool -list -v -keystore <YourJKSFile>.jks The -v option gives you a verbose output where information about each one of the certificates in your.jks file will be written out. If you look through the output for Certificate[ you will find the beginning of the data each of the certificates in your file. If you don t already have an SSL certificate You can create a new.jks file with a private key and a self signed certificate using keytool. For example let s create new.jks file called example.jks: keytool -genkey -alias example -keyalg rsa -keysize 2048 \ -keystore example.jks We used the alias example here; you can assign anything you like. The alias is a name assigned to this specific certificate (or chain) in this keystore file. You will first be prompted for the password to be assigned to the.jks file. Enter keystore password: Re-enter new password: Then you will be asked for a few pieces of information about your domain name and your company:

4 What is your first and last name? [Unknown]: <Your Conpany s domain> What is the name of your organizational unit? [Unknown]: <Your Company s Name> What is the name of your organization? [Unknown]: <Your Company s Name> What is the name of your City or Locality? [Unknown]: <Your Company s City> What is the name of your State or Province? [Unknown]: <Your Company s State> What is the two-letter country code for this unit? [Unknown]: <Your Company s Country Code (e.g. US)> Next you will be prompted with a summary of the information you provided and asked to confirm if it is correct. If it is then you can just hit y and return: Is CN= OU=Your Company Name, O=Your Company Name, L=Your City, ST=Your State, C=Your Country correct? [no]: y Next you will be prompted for a password to assign to this alias (the alias is assigned name for this certificate or chain). If you just hit return then the same password you assigned to the keystore (.jks) file itself will also be assigned to this alias. Enter key password for <example> (RETURN if same as keystore password): OK, now you should have a file called example.jks with your private key and self signed certificate. Your next step will be to select a certifying authority to purchase an SSL certificate from. They will ask you for a certificate signing request (csr) generated from your self signed certificate. You can generate a.csr file for your cert like this: keytool -certreq -alias example -keystore example.jks \ -file example.csr Now you should have a file called example.csr that contains the certificate signing request for your domain. Often you will copy the data from this file and paste it into a form on your CA s website but the process varies from CA to CA. When your CA confirms your identity they will send you your signed certificate, typically in a.cer or.crt (both are PEM formatted files) file. This can be imported into your.jks file, replacing your self signed certificate by entering: keytool -import trustcacerts alias example \

5 -file example.cer -keystore example.jks If the certificate requires that certain intermediate certificates be installed and they are not included in the chain in the.cer file your CA sent you then you will be notified that the certificate is not trusted (because the chain can not be established from your certificate back to a trusted cert because the intermediate certs are missing) and asked if you want to import anyway.... is not trusted. Install reply anyway? [no]: yes If the fingerprint for the certificate matches what you expect then you can reply yes and hit return. Next you will need to locate the intermediate certificates from the CA (they will typically provide them with the certificate file or possibly a link to them on their website). If you need to install intermediate certificates you can do so using the following command for each one of the certificates to be installed (note, each intermediate certificate should be imported under a unique alias into your.jks file): keytool -import trustcacerts alias intermediate1 \ -file intermediate.crt -keystore example.jks Advanced Configuration Settings If you need to add additional behavior to the RTP Server you can use the advanced configuration settings to do that. If you click on the Advanced button in the Configuration pane then the RTP On Event Script pane will slide into the main area in the window.

6 The RTP On Event Script pane allows you to define a script that will be invoked when a defined event occurs in the RTP Server. Currently those events are: ADDED_CONNECTION_HANDLER, EVENT_ORDER_FILE_READY and TEST_NOW_BUTTON. Like in a ROES Server Custom Listener there is popup menu where you can select the language that you are writing your script in. Similarly there is a Test Now button which will invoke the script directly when it is clicked. When your script is invoked it will have the same three global variables available to it that exist in any context in which a script is executed in the ROES Server: greportmacros, goutputwriter and gsystemdata. Data about the report context Field Type Description ReportMacros Hashtable A Hashtable containing all the current macro values given the context of the script block. This is the same object referenced by greportmacros.

7 Field Type Description OutputWriter java.io.stringwriter A StringWriter that can be used to generate the data that this report block will evaluate to. This is the same object referenced by goutputwriter. Other handy data Field Type Description PersistentSystemData Hashtable A Hashtable reference to the global persistent data of this workstation. SystemDataKeys ArrayList<String> An array list containing the field names in the gsystemdata object. In the context of a script in the RTPServer the greportmacros is mainly a mechanism for passing data to the script and sometimes back from the script. Any content written to the goutputwriter will simply be written to the RTPServer log. The gsystemdata will contain ReportMacros, OutputWriter, SystemDataKeys and PersistentSystemData. Just like the ROES Server, the PersistentSystemData can be used to preserve data between invocations of your script. When your script is called the event that is being reported will be one of the items included in the greportmacros hash table. Below is the data available in the greportmacros for each of the events in the RTP Server. Additional greportmacros Items on ADDED_CONNECTION_HANDLER event Field Type Description RTP_EVENT_NAME String The name of the event ADDED_CONNECTION_HANDLER REMOTE_ADDRESS String The address of the client that has connected to the RTP Server The ADDED_CONNECTION_HANDLER event will be sent to your script before a separate thread is established to handle communications with the client so it is essential that your script not try to do anything that will take a lot of time. If you must do something potentially time consuming on this event then your event handler should create a separate thread to actually perform its work and allow the server to proceed normally.

8 Additional greportmacros Items on ORDER_FILE_READY event Field Type Description RTP_EVENT_NAME String The name of the event ORDER_FILE_READY REMOTE_ADDRESS String The address of the client that has connected to the RTP Server ORDER_FILE_PATH String Path to the file that has completed its transfer. Note: This value is a read/write. i.e. On entry it s telling you where the file is that has completed its transfer and after execution it is telling the RTP Server where that file is now. The ORDER_FILE_READY event will be sent to your script after a file has successfully completed its transmission to the RTP Server but before the RTP Server has broadcast its message to the ROES Servers that the file is ready. When your script completes, the RTP Server will then read the current value for ORDER_FILE_PATH from the greportmacros and report that to the ROES Servers (if it s configured to send an ensemble message). If your script moves the location of the order file, you will need to call greportmacros.put( ORDER_FILE_PATH, <new path to the order file>); before it completes. Additional greportmacros Items on TEST_NOW_BUTTON event Field Type Description RTP_EVENT_NAME String The name of the event TEST_NOW_BUTTON The TEST_NOW_BUTTON event will be sent to your script when the user clicks on the Test Now button. Exceptions thrown out of your script If your script throws an exception out to the RTP server it will be caught and reported in the RTP Server log. If you script was invoked by the Test Now button then a dialog will also be presented alerting you to the fact that your script threw out an exception. Apart from reporting the exception, the exception should not interfere with the servers normal processing.

SSL/TLS Certificate Generation

SSL/TLS Certificate Generation Last updated: 11/01/2016 Table of contents 1 INTRODUCTION...3 2 PROCEDURES...4 2.1 Creation and Installation...4 2.2 Conversion of an Existing Certificate Chain Available