Configuring HTTPS

HTTPS ensures that the communication between clients and Spotfire Server is encrypted.

Before you begin

Obtain a server certificate and private key, stored in a Java keystore (JKS) or PKCS #12 keystore (P12/PFX).

About this task

Note: Creating or obtaining certificates, private keys, or a standard Java or PKCS #12 keystore is outside of the scope of the Spotfire Server guidance. See one of the many available technical sources for generating these artifacts.

Procedure

Stop Spotfire Server.
Copy the keystore file to the <server installation dir>/tomcat/certs directory.
We suggest using the server's hostname as keystore filename.

Open the configuration file <server installation dir>/tomcat/conf/server.xml in an XML editor or a text editor and locate the section containing the configuration template for an HTTPS connector:

<!-- 
     <Connector port="443"
          maxHttpHeaderSize="65536"
          connectionTimeout="30000"
          enableLookups="false"
          URIEncoding="UTF-8"
          disableUploadTimeout="true"
          server="Spotfire Server"
          compression="on"
          compressibleMimeType="text/html,text/xml,text/plain,text/css,application/json,application/javascript,image/svg+xml,application/xml"
          keepAliveTimeout="30000"
          maxKeepAliveRequests="-1"
          maxThreads="2000"
          SSLEnabled="true"
          scheme="https"
          secure="true">
     <SSLHostConfig certificateVerification="none"
          truststoreFile="./certs/[server hostname].jks"
          truststorePass="changeit"
          truststoreType="jks"
          sslProtocol="TLS"
          protocols="TLSv1.2"
          honorCipherOrder="true"
          ciphers
			...
     <Certificate certificateKeystoreFile="./certs/[server hostname].jks"
          certificateKeystorePassword="changeit"
          certificateKeystoreType="jks"
          certificateKeyAlias="[server hostname]" />
    </SSLHostConfig>
    </Connector>
-->

(In your installation, [server hostname] is replaced with the actual hostname of your server.)

Remove the lines with the comment markers .
Update the certificateKeystoreFile parameter with the name of the keystore file containing the server certificate and private key.
Set the certificateKeystorePassword parameter to the password for the keystore file containing the server certificate and private key.
Set the certificateKeystoreType parameter for your type of keystore:
Option Description
jks Java keystore
pkcs12 PKCS #12 keystore
If the keystore contains more certificates than just the server certificate, then you must set the certificateKeyAlias parameter to the alias for the server certificate and private key.
If you do not plan on enabling X.509 client certificate authentication, then you must remove the trust store type parameters truststoreFile, truststorePass, and truststoreType.
If these artifacts are not removed, then Tomcat can fail to start. For more information about certificate configuration, see the Apache Tomcat documentation.

Option	Description
`jks`	Java keystore
`pkcs12`	PKCS #12 keystore

Disable unencrypted HTTP traffic, as follows:

Locate the section containing the default HTTP connector:

<Connector port="[HTTP port]"
protocol="org.apache.coyote.http11.Http11NioProtocol"
maxHttpHeaderSize="65536"
connectionTimeout="30000"
enableLookups="false"
URIEncoding="UTF-8"
disableUploadTimeout="true"
server="Spotfire Server"
compression="on"
compressibleMimeType="text/html,text/xml,text/plain,text/css,application/json,application/javascript,image/svg+xml,application/xml"
keepAliveTimeout="30000"
maxKeepAliveRequests="-1"
maxThreads="2000" />

(In your installation, [HTTP port] is replaced with the HTTP port of your server.)

Add comment markers  around the HTTP connector configuration:

<!--
<Connector port="[HTTP port]"
protocol="org.apache.coyote.http11.Http11NioProtocol"
maxHttpHeaderSize="65536"
connectionTimeout="30000"
enableLookups="false"
URIEncoding="UTF-8"
disableUploadTimeout="true"
server="Spotfire Server"
compression="on"
compressibleMimeType="text/html,text/xml,text/plain,text/css,application/json,application/javascript,image/svg+xml,application/xml"
keepAliveTimeout="30000"
maxKeepAliveRequests="-1"
maxThreads="2000" />
-->

Start Spotfire Server.