Edge for Private Cloud v. 4.17.09
By default, TLS is disabled for the management API and you access the Edge management API over HTTP by using the IP address of the Management Server node and port 8080. For example:
http://ms_IP:8080
Alternatively, you can configure TLS access to the management API so that you can access it in the form:
https://ms_IP:8443
In this example, you configure TLS access to use port 8443. However, that port number is not required by Edge - you can configure the Management Server to use other port values. The only requirement is that your firewall allows traffic over the specified port.
To ensure traffic encryption to and from your management API, configure the settings in the
/opt/apigee/customer/application/management-server.properties
file.
In addition to TLS configuration, you can also control password validation (password length
and strength) by modifying the management-server.properties
file.
Ensure that your TLS port is open
The procedure in this section configures TLS to use port 8443 on the Management Server. Regardless of the port that you use, you must ensure that the port is open on the Management Server. For example, you can use the following command to open it:
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 8443 -j ACCEPT --verbose
Configure TLS
Edit the /opt/apigee/customer/application/management-server.properties
file to control TLS use on traffic to and from your management API. If this file does not exist,
create it.
Use the following procedure to configure TLS access to the management API:
- Generate the keystore JKS file containing your TLS certification and private key. For more see Configuring TLS/SSL for Edge On Premises.
- Copy the keystore JKS file to a directory on the Management Server node, such
as
/opt/apigee/customer/application
. - Change ownership of the JKS file to apigee:
chown apigee:apigee keystore.jks
where keystore.jks is the name of your keystore file. - Edit
/opt/apigee/customer/application/management-server.properties
to set the following properties. If that file does not exist, create it:conf_webserver_ssl.enabled=true # Leave conf_webserver_http.turn.off set to false # because many Edge internal calls use HTTP. conf_webserver_http.turn.off=false conf_webserver_ssl.port=8443 conf_webserver_keystore.path=/opt/apigee/customer/application/keystore.jks # Enter the obfuscated keystore password below. conf_webserver_keystore.password=OBF:obfuscatedPassword conf_webserver_cert.alias=apigee-devtest
where keyStore.jks is your keystore file, and obfuscatedPassword is your obfuscated keystore password. See Configuring TLS/SSL for Edge On Premises for information on generating an obfuscated password. - Restart the Edge Management Server by using the command:
/opt/apigee/apigee-service/bin/apigee-service edge-management-server restart
The management API now supports access over TLS.
Configure the Edge UI to use TLS to access the Edge API
In the procedure above, Apigee recommended leaving conf_webserver_http.turn.off=false
so that
the Edge UI can continue to make Edge API calls over HTTP.
Use the following procedure to configure the Edge UI to make these calls over HTTPS only:
- Configure TLS access to the management API as described above.
- After confirming that TLS is working for the management API, edit
/opt/apigee/customer/application/management-server.properties
to set the following property:conf_webserver_http.turn.off=true
- Restart the Edge Management Server by using the command:
/opt/apigee/apigee-service/bin/apigee-service edge-management-server restart
- Edit
/opt/apigee/customer/application/ui.properties
to set the following property for the Edge UI. If that file does not exist, create it:conf_apigee_apigee.mgmt.baseurl="https://FQDN:8443/v1"
where FQDN is the full domain name, as per your certificate address of the Management Server, and the port number is the port specified above byconf_webserver_ssl.port
. - Only if you used a self-signed cert (not recommended in a production
environment) when configuring TLS access to the management API above, add the
following property to
ui.properties
:conf/application.conf+play.ws.ssl.loose.acceptAnyCertificate=true
Otherwise, the Edge UI will reject a self-signed cert. - Restart the Edge UI by using the command:
/opt/apigee/apigee-service/bin/apigee-service edge-ui restart
TLS properties for the Management Server
The following table lists all of the TLS/SSL properties that you can set in management-server.properties
:
Properties |
Description |
---|---|
|
Default is 8080. |
|
To enable/disable TLS/SSL. With TLS/SSL enabled (true), you must also set the ssl.port and keystore.path properties. |
|
To enable/disable http along with https. If you want to use only HTTPS, leave the
default value to |
|
The TLS/SSL port. Required when TLS/SSL is enabled ( |
|
The path to your keystore file. Required when TLS/SSL is enabled ( |
|
Use an obfuscated password in this format: OBF:xxxxxxxxxx |
|
Optional keystore certificate alias |
|
If your key manager has a password, enter an obfuscated version of the password in this format: OBF:xxxxxxxxxx |
|
Configure settings for your trust store. Determine whether you want to accept all
TLS/SSL certificates (for example, to accept non-standard types). The default is
|
|
Indicate any cipher suites you want to include or exclude. For example, if you discover vulnerability in a cipher, you can exclude it here. Separate multiple ciphers with a space. For information on cypher suites and cryptography architecture, see: http://docs.oracle.com/javase/8/docs/technotes/guides/security/SunProviders.html#SunJSSE |
|
Integers that determine:
|