Configuring WebServer 7.0 for GlassFish DAS Based Administration of HTTP Load Balancer

Friday Mar 16, 2007

SJSWS 7.0 uses Network Security Services (NSS) to manage security database that stores the keys and certificates. GlassFish (V2) beta ,on the server side, uses Java Keystore (JKS) to manage it's security database.
GlassFish HTTP Load Balancer's advanced administration support, requires SSL setup between the WebServer and the Domain Administration Server (DAS). To set this up requires exporting and importing DAS certificate from the JKS system into the WebServer's NSS based one.

The under mentioned details enlist the steps that an administrator can use to configure this.

Configure GlassFish HTTP Load Balancer on WebServer 7.0 to accept DAS as a trusted client.

1. Create a new HTTP listener and enable it for SSL. While doing so attach the default server certificate available with SJSWS 7.0 installation. For ease you can do this by using the WebServer's GUI based administration console.
2. Use the JavaSE 5.0 security tool keytool for exporting the DAS certificate, named with alais “s1as”. While doing so select the -rfc option to export the certificate in printable encoding format, as defined by the Internet RFC 1421 standard..

   In its printable encoding format, the encoded certificate is bounded at the beginning by:

   -----BEGIN CERTIFICATE-----
and at the end by
-----END CERTIFICATE-----

   Command (Solaris / Linux)
   <JAVA_HOME>/bin/keytool -export -rfc -alias s1as -keystore <GLASSFISH_HOME>/domains/<DOMAIN_NAME>/config/keystore.jks -file s1as.rfc

   where:
   <GLASSFISH_HOME> is the installation directory for GlassFish application server
   <DOMAIN_NAME> refers to the GlassFish domain, DAS, whose certificate is being exported. Also Note this takes into assumption that cluster profile is choosen for this created domain.

3. Use the NSS security tool certutil to import the DAS certificate from the rfc file created.

   <WS_INSTALL_ROOT>/bin/certutil -A -a -n s1as -t "TC" -i s1as.rfc -d <WS_INSTALL_ROOT>/admin-server/config-store/<DEFAULT_CONFIG_NAME>/config
   where, <WS_INSTALL_ROOT> refers to the SJSWS 7.0 installation directory and
   <DEFAULT_CONFIG_NAME> refers to the config name created for the default WebServer
   instance.

   You can check the presence of this certificate by using the following command, which would list s1as certificate along with other CA certificates including the default server certificate :
   <WS_INSTALL_ROOT>/bin/certutil -L -d <WS_INSTALL_ROOT>/admin-server/config-store/<DEFAULT_CONFIG_NAME>/config

   You can also use the SJSWS 7.0 GUI admin console to view this. Select the configuration to which the certificate has been imported to, in our case the default config, and then select the Certificates tab. You can now look at all the certificates available by selecting the Certificate Authorities sub tab. Following is screen shot for this :

   

   Following screen shot relates to the information on the imported DAS certificate nicknamed s1as:

   

Configuration changes to WebServer 7.0

1. Append the following directives to obj.conf file :
   <WS_INTSTALL_ROOT>/admin-server/config-store/<DEFAULT_CONFIG_NAME>/config/obj.conf

   <Object ppath="*lbconfigupdate*">
PathCheck fn="get-client-cert" dorequest="1" require="1"
<Object>

   <Object ppath="*lbgetmonitordata*">
PathCheck fn="get-client-cert" dorequest="1" require="1"
</Object>

Deploy the configuration

1. While doing the changes enlisted above, the admin console would mark this configuration to be deployed. Select the icon for “Deployment Pending”.
   This can also be done by executing the deploy-config WebServer command from WebServer's wadm CLI utility.

   >WS_INSTALL_ROOT>/bin/wadm deploy-config –user=<admin> <DEFAULT_CONFIG_NAME>
   where, <admin> is the admin user name.

Test the SSL connection

1. Test this setup from GlassFish Domain Administration Server (DAS), to communicate over SSL with this configured GlassFish HTTP Load Balancer.
   Following is the screen shot for this “Test Connection” :
   

Like this post? | | | |

Posted at 07:49PM Mar 16, 2007 by pankajjairath in Sun
Tags: