How To: Configure SSL (Issued SSL Certificate) on Connect
This article provides instructions for adding an issuedSSL certificateto the web page hosted by Alteryx Connect so that the page is served securely.
Note: This article is intended for trusted certificates in your environment. You must have a copy of the certificate (such as .crt) and the signing key (such as .key), or a combined certificate file (such as .pfx or .p12) in order to complete this process. This certificate must be installed on all machines you intend to use with Connect as a trusted certificate if these machines are to be used in conjunction with Alteryx Connect, such as loading metadata with Alteryx Designer or search results from Alteryx Connect displayed within Alteryx Designer.
Prerequisites
- Alteryx Connect ≤ 2018.4
- Trusted SSLCertificate
- Administrator Permissions in AlteryxConnect
Procedure
- Stop the service Alteryx Connect via Windows Task Manager or Services dialog.
- Back up the entire Connect install folder, (default C:\Program Files\AlteryxConnect\ ). This folder contains the H2 database as well as configuration files. If you are unable to get Connect to start properly after applying the modifications, you can restore this backup to restore original functionality.
- Open a command prompt (CMD.exe) as administrator (Right Click> Run as Administrator).
- The following steps will depend on the type of certificates you have:
- To import a .pfx or .p12 file:
- Change directory to the jre\bin folder inside the Connect install folder (default C:\Program Files\AlteryxConnect\jre\bin).
cd "C:\Program Files\AlteryxConnect\jre\bin"
- Use the following command to import a .pfx or .p12 file to a new keystore. Replace the value after -srckeystore with your .pfx or .p12 file location and the value after -destkeystore to a directory accessible by the service account (default is SYSTEM or Local System) that is running the Alteryx Connect service. Take note of this location and your keystore password as you will need this information later.
Note:If you are asked for the "source keystore" password during the process, this is the password for your .pfx or .p12 file, not the keystore password.
keytool -importkeystore -srckeystore "C:\Path\to\File\pfxfile.pfx" -srcstoretype pkcs12 -destkeystore "C:\Path\to\File\keystore.jks" -deststoretype JKS
- To import a .key and .crt file combination:
- You will need OpenSSL for this operation. You can find pre-compiled binaries at the following location:
https://wiki.openssl.org/index.php/Binaries
These binaries work well:
http://slproweb.com/products/Win32OpenSSL.html - Once you have OpenSSL installed, change to the directory in Command Prompt with the openssl.exe (typically \bin under the OpenSSL installation directory) and run the following command to combine your cert and key pair. Make sure to replace the value after -in with the path to your .crt file, the value after -inkey with the path to your .key file, the value after -out with the destination combined file location, and the value after -name with a name for the certificate (such as the hostname of the server).
openssl pkcs12 -export -in "C:\Path\to\File\server.crt" -inkey "C:\Path\to\File\server.key" -out "C:\Path\to\File\server.p12" -name ayxconnect01
- Once you have the new .p12 file, please follow the steps above to import a .pfx or .p12 file to a Java keystore file.
- Once you have your keystore file, we can begin to configure Connect. Open the server.xml file within the conf directory inside the Connect install folder (default C:\Program Files\AlteryxConnect\conf) with a text editor such as Notepad.
- Find line 70 within this file, add a new line, and add the following block of text. Modify the Connector port to the port number you wish to run Connect on, if not the SSL/HTTPS default of 443. Modify the keystorePass to the password for your keystore file that you created earlier. Modify the keystoreFile to the file location of your keystore file that you created in Step 4.
The result should look similar to the following (screenshot below in Notepad++):
- Save the server.xml file.
- (Optional - Recommended) If you wish to redirect traffic from port 80 to port 443 (for example, if someone visits http://ayxconnect01.yourdomain.tld and you want them to be redirected automatically to https://ayxconnect01.yourdomain.tld and not simply receive an error message, then we also need to make the following modifications.
- Modify line 68 of the same server.xml file to indicate the redirectPort as 443 (or the port you specified in Step 6 above for Connector port if not default).
- Save the server.xml file.
- Open the web.xml file from the same conf directory with a text editor such as Notepad.
- Find line 4680 within this file and insert the following block of text. Please verify that the item inserted is just before the XML tag.
Automatic Forward to HTTPS/SSL /* CONFIDENTIAL
The result should look like the following:
- Save the web.xml file.
- Start the service Alteryx Connect via Windows Task Manager or Services dialog. Allow at least 5-10 minutes for service to fully initialize all web services.
- Browse to the (now SSL-enabled) URL via a browser (i.e. https://ayxconnect01.yourdomain.tld ). If you specified a non-default port in the steps above for your SSL configuration, make sure to add the port to the end of the URL, preceded by a colon : (i.e. https://ayxconnect01.yourdomain.tld:8443 ).
- Verify that Alteryx Connect is operational. If Connect is not operational, check log files for potential errors in XML files that were edited or other error messages. Verify your SSL port is allowed through any firewalls on the machine or on the network.
- Update the Base URL to the SSL-enabled URL within Connect Admin settings:
- Click the icon in the upper-right corner of the Connect page >Administration.
- ClickConnect Configuration>Instance Settings.
- Update theBase URL value to the new SSL-enabled URL.
- ClickSave at the bottom of the page.
Additional Resources