Пользовательский SSL Сертификат

Теперь в Jelastic доступны Пользовательские SSL сертификаты! Это обеспечивает такой уровень безопасности доменных имен, которого у Вас никогда не было прежде. С Jelastic хостинг приложений, которым нужна поддержка SSL, становится очень простым.

Jelastic предоставляет возможность загружать и использовать пользовательские сертификаты. Все, что Вам нужно - это пользовательское доменное имя и Внешний IP.

Jelastic поддерживает следующие типы сертификатов:

  • Single domain
  • Self-signed
  • Wildcard
  • Multiple domain
  • Extended validation single domain
  • Extended validation multiple domain
  • UCC Exchange
  • Low assurance/domain-validated certificate
  • Code signing certificate
  • Email certificate
  • Root signing certificate
  • Shared SSL и т.п.

  1. Требования для добавления Пользовательских Сертификатов

  2. Чтобы добавить Пользовательский SSL для Вашего Jelastic окружения, Вам необходимо:

    1. Доменное имя;
    2. Серверный ключ;
    3. Промежуточный сертификат (СА);
    4. Сертификат домена.

    Через любой регистратор домена приобретите Доменное имя.

    Используя OpenSSL(или любую другую программу) сгенерируйте Ваш серверный ключ и создайте на его основе Запрос Сертификата.

    Отправьте этот Запрос Сертификата в желаемый Центра сертификации (СА).

    CA проверит личность владельца домена и (если все в порядке) вышлет Промежуточный сертификат и Сертификат домена.

  3. Создание окружения

    1. Войдите в панель управления
      Jelastic
    2. Нажмите Создать окружение:
    3. В диалоговом окне Топология окружения выберите сервер приложения (например, Tomcat 7). Включите Внешний IP. Введите имя окружения и нажмите кнопку Создать.

    4. Примечание: Вы можете перейти в раздел SSL в визарде и нажать кнопку Купить SSL сертификат. В этом случае Вы будете перенаправлены на страницу, где можно заказать SSL сертификат. После завершения всех необходимых шагов Вы получите комплект необходимых файлов (Приватный ключ, Промежуточный сертификат (СА) и Сертификат домена).

      Через минуту Ваше окружение появится в списке.


  4. Доменное имя и настройка А-записей

    1. Скопируйте Внешний IP, который Вы получили после создания окружения. Для этого нажмите дополнительную кнопку (стрелка вниз) для сервера приложений в Вашем окружении. Вы увидите Ваш Внешний IP-адрес. Скопируйте его.


    2. Теперь перейдите к Вашему DNS Менеджеру.
    3. Настройте A-запись, чтобы указать соответствие Вашего домена Вашему внешнему IP-адресу. Детальную инструкцию о том, как это сделать, Вы можете найти здесь.

  5. Загрузка Сертификата в окружение

    1. Нажмите кнопку Настройки для созданного окружения. Выберите в списке Пользовательский SSL.
    2. Загрузите Серверный ключ, Промежуточный сертификат (СА) и Сертификат домена. Нажмите Сохранить.


    3. Это всё! Теперь Вы можете использовать SSL для Вашего пользовательского доменного имени!

Generate a Custom SSL Certificate

In order to add the Custom SSL certificate to your Jelastic environment, you need to have:

  • custom domain name purchased;
  • server key;
  • intermediate certificate or certificates chain (CA);
  • domain certificate.

Therefore, follow the next instruction:

1. Buy a Domain name using any domain registrar (e.g. mysite.com).

2. Generate your server key for the purchased domain name and create a Certificate Request on its basis with the help of any preferred tool.

We’ll use OpenSSL as an example. Depending on the operating system you are using, perform the following steps:

For Windows

Download the latest OpenSSL tool version. Extract the received archive and run the tool by double-clicking the openssl.exe file in the bin folder. Subsequently the files created with OpenSSL will appear in the same bin directory by default.

  • First, you need to generate an SSH private server key. For that execute the following command:

genrsa -out {filename} {length}

where

{filename} - name of the output key file with .key extension (e.g. server.key)

{length} - private key length in bits (e.g. 4096)

Note: DO NOT protect your key with a passphrase, otherwise you'll get an error during its addition to the Jelastic dashboard.

  • Then you should generate a certificate request based on the prepared key. Create it as follows:

req -config {config_path} -new -key {keyname} -out {filename}

where

{config_path} - path to the openssl.cnf configuration file, located in the directory with extracted OpenSSL files (specified according to the C:\path\to\openssl.cnf format)
{keyname} - your server key name (the one you’ve generated in the previous step, server.key in our case)

{filename} - desired name of the output request file with .csr extension (e.g. server.csr).

You’ll see a set of questions appear. Answer them in order to complete the certificate information with your data.

IMPORTANT: Note that the Common Name parameter value has to be equal to your purchased domain name, otherwise your certificate won't be validated.

For Linux/MacOS/FreeBSD

In case you don’t have the OpenSSL tool installed yet, get it with the appropriate command (according to your OS package manager) executed within your terminal. E.g. for Ubuntu/Debian Linux distribution use the following one:

sudo apt-get install openssl

When the installation process is completed, proceed to generation of the required files. All newly created with OpenSSL files will appear in the home directory of your local machine user by default.

  • First, you need to generate an SSH private server key. For that run the following command:

openssl genrsa -out {filename} {length}

where

{filename} - name of the output key file with .key extension (e.g. server.key)

{length} - private key length in bits (e.g. 4096)

Note: DO NOT protect your key with a passphrase, otherwise you'll get an error during its addition to the Jelastic dashboard.

  • Then you should generate a certificate request based on the prepared key. Create it as follows:

openssl req -new -key {keyname} -out {filename}

where

{keyname} - your server key name (the one you’ve generated in the previous step, server.key in our case)

{filename} - desired name of the output request file with .csr extension (e.g. server.csr).

You’ll see a set of questions appear. Answer them in order to complete the certificate information with your data.

IMPORTANT: Note that the Common Name parameter value has to be equal to your purchased domain name, otherwise your certificate won't be validated.

3. Send the Certificate Request you’ve received to your preferred Certificate Authority (CA) company for signing.

You can also sign certificates yourself. Follow this link to see the detailed instruction.

4. The chosen CA checks the identity of the domain owner and (if everything is ok) sends the Intermediate certificate and Domain certificate back to you.

Once you’ve received all the required files, you can proceed to configuring your environment.

Adjust Environment Topology

In order to be secured with a Custom SSL certificate, your environment should have custom domain and Public IP address attached to your application server.

Note:

  • for .NETPython and Node.js applications, your environment should also include the NGINX-balancer server. In this case, the external IP address should be attached to the balancer instead of application server as NGINX becomes the entry point of your app
  • for the Docker®-based environments, only the Jelastic SSL option is available currently

1. Log into the Jelastic dashboard and create a New environment (or click the Change environment topology button for an existing one).

2. In the opened Environment Topology dialog, click on the SSL switcher above the servers blocks and check if all the Custom SSL requirements are fulfilled (i.e. if all the options in the requirements list are marked with a green tick).

If they are not, Jelastic can help you to Adjust your environment in just a one click. For that select the appropriate button next to the list of requirements and your environment topology will be instantly tuned according to them.

To complete the adjustment, click Create for a new environment or click on Apply in case you’ve edited the existing one.

Domain Name and A Record Settings

Now you need to set an A Record in order to point your custom domain name to the Public IP address of your application.

1. Select the additional button for a node with the external IP attached in your environment (i.e. for the NGINX-balancer server in case of .NET/Python/Node.js usage, or for the application server in all other cases).

You’ll see the list of IPs, wherein the second one is the required Public IP address. Click on it to select the whole line and copy the digits to your clipboard.

2. Then, navigate to DNS Manager of the chosen domain registrar system (the one you’ve used for your custom domain name purchase) and set an A Record within it.

Additional information and a detailed example can be found in the appropriate document (starting at the 5th step of the Domain Name and A Record Settings section).

Upload Certificate to the Environment

The last step you need to perform, is to upload the certificate files to your Jelastic environment.

1. Click Settings for the configured environment.

2. In the opened tab, choose the Custom SSL option within the left-hand list.

Upload Server key, Intermediate certificate (CA) and Domain certificate into the appropriate fields. Click Save.

When the servers in your environment are automatically restarted, let’s ensure everything works properly. For that, enter the binded custom domain name (or the attached external IP address) into your browser’s address bar with https:// connection protocol specified instead of the default http:// one. Your application should be opened without any problems.

That's all! Now you can be confident all the received/sent by your application data is secured and encrypted.