Denodo SSL/TLS Configurator Script¶

The SSL/TLS configuration script automates the process of enabling SSL in all the modules of the Denodo Platform and the Solution Manager, including the web container (Apache Tomcat).

This script is located in <DENODO_HOME>/bin/denodo_tls_configurator and it does this:

• Generates a keystore with the provided private key (only in some scenarios).

• Imports the provided public certificates in the selected truststore.

• Modifies all the relevant configuration files.

• Performs other auxiliary actions, such as enabling the HTTPS connector and the use of an external SSL/TLS configuration file in the embedded Apache Tomcat.

Note that there are some configuration steps that may be required even when using the SSL/TLS configuration script:

• Obtaining and Installing an SSL/TLS Certificate: when using a PKCS12 keystore and a CER certificate with the script, you may need to check the following sub-sections:

  • Create a Keystore with a Self-Signed Certificate

  • Send a Certificate Request to a Certificate Authority (CA) and Create a Keystore with the Reply

• Enabling SSL/TLS for External Clients

There are four operation modes available, based on the performed action (enabling or disabling SSL/TLS) and the required input files:

1. Enable SSL/TLS Using a PKCS12 Keystore and Public Certificates in CER Format

2. Enable SSL/TLS Using a PKCS #12 Bundle

3. Enable SSL/TLS Using PEM-Encoded Key and Certificates

4. Disable SSL/TLS

Before diving into the details of each mode, we are going to explain some common configuration parameters that appear in all or most of the operation modes:

• --denodo-home <path>: path to the target Denodo Platform or Denodo Solution Manager installation.

• --components component_1,...,component_n: comma-separated list of Denodo components that will be configured (choose between license-manager, scheduler, scheduler-index, solution-manager, tomcat, vdp and vdp-admin). Note that not all the components will be available, depending on the type of target installation (Denodo Platform or Denodo Solution Manager). If --components is not set, all the available components will be configured (this is the recommended approach).

• --keystore <path>: path to the PKCS12 keystore to be used by the selected Denodo components. If it does not exist, it will be generated (except when enabling SSL/TLS using a PKCS12 keystore and public certificates in CER format).

  Note

  This parameter is not required when configuring client applications only. This will happen if:

  • The --components option’s value is set and its value contains vdp-admin and/or wgt only.

  • The --components option’s value is not set and the target installation includes the Virtual DataPort Administration Tool and/or the Wrapper Generator Tool only.

• --truststore <path>: path to the truststore to be used by the selected Denodo components. This truststore must exist: the script will import all the required certificates into it. For instance, you can use <DENODO_HOME>/jre/lib/security/cacerts.

• --credentials-file <path>: Path to a properties file with encrypted values for keystore.password, truststore.password and/or pkcs12bundle.password, as required by the script’s configuration. Encrypted values must be generated with the <DENODO_HOME>/bin/encrypt_password.bat/.sh script.

  Credentials file sample¶

  keystore.password=<encrypted_value>
  truststore.password=<encrypted_value>
  pkcs12bundle.password=<encrypted_value>
  

• --license-manager-uses-tls={true|false}: this parameter is only useful for Denodo Platform installations and will be ignored if the target is a Denodo Solution Manager installation. It must be set to true when the target Denodo Platform installation is configured to connect to a SSL/TLS-enabled License Manager, or to false otherwise. See Configuring the Connection to the License Manager for details.

• --override: this parameter overrides previous keystore and truststore configuration, making a backup of the existing files, but only when the script modifies them. An example of a backup of the truststore could be <DENODO_HOME>/jre/lib/security/cacerts.back.20230815123456789.

Also, you can display the script’s help by executing <DENODO_HOME>/bin/denodo_tls_configurator.bat/.sh without parameters.

denodo_tls_configurator
    --keystore <path>
    --cert-cer-file <path>
    [ --cert-chain-cer-file <path> ]
    --truststore <path>
    [ --override ]
    [ --license-manager-uses-tls={true|false} ]
    [ --components component_1,...,component_n ]
    --credentials-file <path>
    --denodo-home <path>

denodo_tls_configurator
    --pkcs12-file <path>
    --keystore <path>
    --truststore <path>
    [ --override ]
    [ --license-manager-uses-tls={true|false} ]
    [ --components component_1,...,component_n ]
    --credentials-file <path>
    --denodo-home <path>

denodo_tls_configurator
    --keystore <path>
    --key-pem-file <path>
    --cert-pem-file <path>
    [ --cert-chain-pem-files <path_1>,...,<path_n> ]
    --truststore <path>
    [ --override ]
    [ --license-manager-uses-tls={true|false} ]
    [ --components component_1,...,component_n ]
    --credentials-file <path>
    --denodo-home <path>

denodo_tls_configurator
    [ --license-manager-uses-tls={true|false} ]
    [ --components component_1,...,component_n ]
    --disable-tls
    --denodo-home <path>