Enabling HTTPS in the Embedded Apache Tomcat

The Denodo Platform embeds the Apache Tomcat web container to host its web applications and web services. The communications between clients and the web applications running in the Apache Tomcat embedded in the Denodo Platform can be secured with HTTPS. The applications running in this web container are:

  • ITPilot Administration Tool
  • Scheduler Administration Tool
  • Web Services published using Virtual DataPort
  • Data Catalog
  • Diagnostic & Monitoring Tool

To enable HTTPS, do the following:

  1. Stop all the Denodo servers of this installation. The goal is to stop the web container of Denodo. It is important to stop them all so the Denodo web container is stopped as well. If for example, you leave the Data Catalog started, the web container will not shut down and the changes in the file tomcat.properties will not take effect.
  2. Edit the file <DENODO_HOME>/resources/apache-tomcat/conf/tomcat.properties, uncomment the following properties and set their value:
com.denodo.tomcat.http.port

If you want to disable http and only allow https, comment this property.

If you want to allow http and https, leave this property as is.

com.denodo.tomcat.https.port

Port listening to https connections. Check that this port is free in this host.

If you want clients to access the HTTPs interface without having to put the port in the URL, set this to 443 instead of 9443. That way, the user will be able to access the HTTPs interface with a URL like https://denodo-server.acme.com/denodo-restfulws instead of https://denodo-server.acme.com:9443/denodo-restfulws.

Note that in Linux, processes that are not started by the root user cannot listen on ports under 1024. However, it is possible, using iptables, to redirect the data to port 443 to the port 9443.

com.denodo.security.ssl.enabled Set to true
com.denodo.security.ssl.keyStore

Path to the KeyStore that contains the certificate for the Denodo Platform servers.

For example, com.denodo.security.ssl.keyStore= C:/denodo/denodo_server_key_store.jks

Even if the Denodo servers run on Windows, the path separator has to be the forward slash (/).

com.denodo.security.ssl.keyStorePassword Password of the KeyStore that contains the certificate for the Denodo Platform servers.

com.denodo.security.ssl.trustStore

com.denodo.security.ssl. trustStorePassword

Leave these two properties commented.
  1. Edit the file <DENODO_HOME>/resources/apache-tomcat/conf/server.xml
    1. Uncomment the SSL connector. I.e. Search the “Connector” element that starts with <Connector port=”${com.denodo.tomcat.https.port}” and remove the <-- and --> characters that surround it.
    2. To disable the access through HTTP and only allow HTTPs connections, comment the “Connector” element that starts with <Connector port=”${com.denodo.tomcat.http.port}” with <-- and -->. For example,
<!--
   <Connector port="${com.denodo.tomcat.http.port}"
      maxThreads="150" minSpareThreads="25"
      redirectPort="${com.denodo.tomcat.https.port}"
      connectionTimeout="20000"
      URIEncoding="UTF-8"/>
-->
Check the documentation of Apache Tomcat to know how to change the default SSL/TLS settings of the web container: to limit the ciphers, enable client authentication, etc.
  1. Start the Denodo Platform servers.

    It is important to stop them all before any change (step #1) so the Denodo web container is stopped as well.

  2. To check that HTTPs was enabled successfully, open the URL https://denodo-server.acme.com:9443/denodo-restfulws/admin (9443 is the default value of the property com.denodo.tomcat.https.port).

Additional Information about the TrustStore (cacerts file)

By leaving the properties com.denodo.security.ssl.trustStore and com.denodo.security.ssl.trustStorePassword commented on the file tomcat.properties, the web container uses the default TrustStore of the installation (<DENODO_HOME>/jre/lib/security/cacerts).

It is possible to configure the Denodo web container to use a TrustStore that is not the default one. However, we do not recommend doing so because it makes the management of the Denodo servers harder because you have to maintain a new TrustStore file.

To use a different TrustStore, uncomment these properties:

  • com.denodo.security.ssl.trustStore = Path to the TrustStore.

    For example, com.denodo.security.ssl.trustStore=c:/denodo/custom_cacerts

    Even if the Denodo servers run on Windows, the path separator has to be the forward slash (/).

  • com.denodo.security.ssl.trustStorePassword = Password of the TrustStore. The default password of a TrustStore is changeit.

Enabling HTTPs on the Web Container but not in the Virtual DataPort Server

It is possible to enable HTTPs on the web container without enabling SSL in the Virtual DataPort server. If you did not enable SSL/TLS on the Virtual DataPort server, leave the property com.denodo.security.ssl.enabled of tomcat.properties commented.