Managing Web Application Container Servers (WACS)
You cannot delete the last service from a WACS. Therefore, if you are removing a web service from a
WACS, you must ensure that the server is hosting at least one other service.
If you want to remove the last service from a WACS, delete the WACS itself.
1.
Go to the "Servers" management area of the CMC.
2.
Double-click the WACS that you want to remove the web service from, and view the properties of the server to ensure that the web service that you want to remove is present.
3.
Click Cancel to return to the "Servers" screen.
4.
Stop the WACS by right-clicking the server and clicking Stop Server.
If you are trying to stop the WACS that is currently serving the CMC to you, a warning message appears. Don't proceed unless you have at least one additional running BOE Web Application Service on another WACS in your deployment. If you do, click OK, log on to another WACS, and start this procedure from the beginning.
5.
Right-click the WACS and choose Select Services.
The "Select Services" screen appears.
6.
Select the service that you want to remove, click <, and then click OK.
7.
Start the WACS by right-clicking the server and clicking Start Server.
The service is removed from the WACS.
10.1.4 Configuring HTTPS/SSL
You can use the Secure Sockets Layer (SSL) protocol and HTTP for network communication between clients and WACS in your Information platform services deployment. SSL/HTTPS encrypts network traffic and provides improved security.
There are two types of SSL:
• SSL used between Information platform services servers, including WACS and other Information platform services servers in your deployment. This is known as CorbaSSL. For more information on using SSL between the Information platform services servers in your deployment, read about communication between Information platform services components in a firewall in this guide.
• HTTP over SSL, which occurs between WACS and clients (for example, browsers) that communicate with WACS.
Note:
If you are deploying WACS in a deployment with a proxy or reverse proxy, and want to use SSL to secure the network communication in your deployment, you must create two WACS. See the information about using WACS with a reverse proxy in this guide.
To configure HTTPS/SSL on a WACS, you must complete these steps:
• Generate or obtain a PKCS12 certificate store or JKS keystore which contains your certificates and private keys. You can use Microsoft's Internet Information Service (IIS) and Microsoft Management
323 2012-11-26
Managing Web Application Container Servers (WACS)
Console (MMC) to generate a PCKS12 file, or use openssl or the Java keytool command line tool to generate a keystore file.
• If you want only certain clients to connect to a WACS, then you must generate a certificate trust list file.
• When you have a certificate store and, if necessary, a certificate trust list file, copy the files to the
WACS machine.
• Configure HTTPS on the WACS.
Related Topics
•
To configure the system for firewalls
•
Understanding communication between Information platform services components
•
Using WACS with a reverse proxy
324
10.1.4.1 To generate a PKCS12 certificate file store
There are many ways of generating a PKCS12 certificate file stores or Java keystores, and tools that you can use. The method that you use depends on the tools that you have access to and are familiar with.
This example demonstrates how to generate a PKCS12 file using Microsoft's Internet Information
Services (IIS) and the Microsoft Management Console (MMC).
1.
Log on to the machine that hosts WACS as an administrator.
2.
In IIS, request a certificate from Certificate Authority. For information on doing this, see the IIS help documentation.
3.
Start the MMC by clicking Start > Run, typing mmc.exe, and clicking OK.
4.
Add Certificates Snap-in to the MMC: a.
From File menu, click Add/Remove Snap-in.
b.
Click Add.
c.
On the "Add Standalone Snap-in" dialog box, select Certificates, and click Add.
d.
Select Computer account, and click Next.
e.
Select Local Computer, and click Finish.
f.
Click Close, and click OK.
The Certificates Snap-In is added to the MMC.
5.
In the MMC, expand Certificates, and select the certificate that you want to use.
6.
On the Action menu, select All Tasks > Export.
The "Certificate Export Wizard" starts.
7.
Click Next.
8.
Select Yes, export the private key, and click Next.
2012-11-26
Managing Web Application Container Servers (WACS)
9.
Select Personal Information Exchange - PKCS #12 (.PFX), and click Next.
10.
Enter the password you used when you created the certificate and click Next. You must specify this password in the Private Key Access Password field when you configure HTTPS for the WACS.
A PKCS12 certificate file store is created.
10.1.4.2 To generate a Certificate Trust List
1.
Log on to the machine that hosts WACS as an administrator.
2.
Start the Microsoft Management Console (MMC).
3.
Add the Internet Information Services Snap-in: a.
From the File menu, select Add/Remove Snap-in, and click Add.
b.
In the "Add Standalone Snap-in" dialog, select Internet Information Services (IIS) Manager, and click Add.
c.
Click Close, and click OK.
The IIS snap-in is added to the MMC.
4.
In the left pane of the MMC, find the web site for which you want to create the Certificate Trust List.
5.
Right-click the web site, and select Properties.
6.
Click the Directory Security tab, and under "Secure Communications", click Edit.
7.
Click Enable certificate trust list, and click New.
The "Certificate Trust List Wizard" starts.
8.
Click Next.
9.
Click Add from Store or Add from File, select the certificate that you want to add to the Certificate
Trust List, click OK, and click Next.
10.
Type a name and description for the Certificate Trust List, and click Next.
11.
Click Finish, and then click OK.
The Certificate Trust List is displayed in the Current CTL field.
12.
Select the Certificate Trust List and click Edit.
The "Certificate Trust List Wizard" starts.
13.
Click Next.
14.
On the Current CTL certificates list, select the Trust List, and click View Certificates.
15.
Click the Details tab, and click Copy to File.
The "Certificate Export Wizard" starts.
16.
Click Next.
17.
Select Yes, export the private key, and click Next.
18.
Select Personal Information Exchange - PKCS #12 (.PFX), and click Next.
325 2012-11-26
Managing Web Application Container Servers (WACS)
19.
Enter the password you used when you created the certificate and click Next. You must specify this password in the Certificate Trust List Private Key Access Password field when you configure
HTTPS for the WACS.
10.1.4.3 To configure HTTPS/SSL
Before you configure HTTPS/SSL on your WACS, ensure that you've already created a PCKS12 file or JKS keystore, and that you've copied or moved the file to the machine that is hosting the WACS.
1.
Go to the "Servers" management area of the CMC.
2.
Double-click the WACS the server for which you want to enable HTTPS.
The "Properties" screen appears.
3.
In the "HTTPS Configuration" section, check the Enable HTTPS check box.
4.
In the Bind to Hostname or IP Address field, specify the IP address for which the certificates were issued and to which WACS will bind.
HTTPS services will be provided through IP address that you specify.
5.
In the HTTPS Port field, specify a port number for WACS to provide HTTPS service. You must ensure that this port is free. If you plan to allow users to connect to the WACS from outside a firewall, you must also ensure that this port is open on the firewall.
6.
If you are configuring SSL with a reverse proxy, specify the proxy server's hostname and port in the
Proxy Hostname and Proxy Port fields.
7.
On the Protocol list, select a protocol. The available options are:
•
SSL
SSL is the Secure Sockets Layer protocol, which is a protocol for encrypting network traffic.
•
TLS
TLS is the Transport Layer Security protocol, and is a newer, enhanced protocol. The differences between SSL and TLS are minor, but include stronger encryption algorithms in TLS.
8.
Under the Certificate Store Type field, specify the file type for the certificate. The available options are:
•
PKCS12
Select PKCS12 if you are more comfortable working with Microsoft tools.
•
JKS
Select JKS if you are more comfortable working with Java tools.
9.
In the Certificate Store File Location field, specify the path where you copied or moved the certificate file store or Java keystore file.
10.
In the Private Key Access Password field, specify the password.
326 2012-11-26
