Configure microservices for self-signed certificates

If the service dispatcher is and the TLS certificate used is self-signed, each microservice on a node must be configured to trust the self-signed certificate. The following instructions apply to microservices that communicate with a server using a self-signed certificate. These steps describe how to configure the microservices with the Certificate Authority. Table 1: For these microservices Do this iModel Viewer Service (Source code language: Javascript/Typescript using NodeJS) Prerequisite: The certificate must be in the PEM format and must not have been generated using DSA encryption. Edit the file %TC_ROOT%\microservices\services_config<microservice>.json. In the environment section, add the environment variable NODE_EXTRA_CA_CERTS and set it to point to the location of the certificate. Example: For additional information about this variable, see NodeJS documentation. Restart the process manager. ep-app FileRepo mfe-vis odata_service req-compare-service (Source code language: Java) Ensure that the following two arguments are passed to the JVM: -Djavax.net.ssl.trustStorePassword=password -Djavax.net.ssl.trustStore=path_to_trust_store_file_in _.jks_format The method for doing this for Java-based microservices depends on their implementation. The preferred method is to edit the TC_ROOT\microservices\services_config\microservice.json file to alter the JVM arguments. For most microservices, the .json file has an ARGS variable, to which you can append arguments. Some microservices, notably odata_service, require that you modify the corresponding TC_ROOT\microservices\microservice\start_service.bat script to add the JVM arguments. Restart the process manager. Command Prediction Google Online Office Online Product Configurator Service reqexportservice reqimportservice Teamcenter Share (Source code language: C#) If the trust store file is in .jks format, convert the .jks file to .pk12. To convert a keystore file named keystore2.jks to a .pk12 file using the key mykey and the password testKeyStorepw, run the command: Copy keytool -importkeystore -srckeystore [./keystore2.jks] -destkeystore ./keystore2.p12 -srcstoretype JKS -deststoretype PKCS12 -srcstorepass testKeyStorepw -deststorepass testKeyStorepw -srcalias mykey -destalias mykey -srckeypass testKeyStorepw -destkeypass testKeyStorepw -noprompt Double-click the .pk12 file to install it as a trusted certificate. Table 2: For these microservices Do this iModel Viewer Service (Source code language: Javascript/Typescript using NodeJS) Prerequisite: The certificate must be in the PEM format and must not have been generated using DSA encryption. Edit the microservice configuration (YAML) file. In the environment section, add the environment variable NODE_EXTRA_CA_CERTS and set it to point to the location of the certificate. Example Copy version: "3.3" services: darsi: image: myCorp:5000/teamcenter/afx-darsi:1.6.5 deploy: mode: replicated replicas: 1 environment: - FSC_URL=http://service_dispatcher:9090/filerepo - MSR=http://eureka:8080/eureka/v2/ - NODE_ENV=production - NODE_EXTRA_CA_CERTS=/run/secrets/cert_file_name.pem logging: driver: fluentd options: fluentd-address: 0.0.0.0:24223 fluentd-async-connect: 'true' tag: 'msf.{{.Name}}.{{.ID}}' depends_on: - eureka secrets: - validator_keystore.pem - cert_file_name.pem secrets: validator_keystore.pem: file: ./secrets/validator_keystore.pem cert_file_name.pem: file: ./secrets/cert_file_name.pem For additional information about this variable, see NodeJS documentation. To update a running container image, deploy the updated ChangeMeServiceName microservice files. ep-app FileRepo mfe-vis odata_service req-compare-service (Source code language: Java) Ensure that the following arguments are passed to the JVM: -Xmx2048m -Xss228k -Djavax.net.ssl.trustStorePassword=trust_store_password -Djavax.net.ssl.trustStoreType=trust_store_type Note Enter the appropriate type, one of jks or pkcs12. -Djavax.net.ssl.trustStore=path_to_truststore_file Example Copy version: "3.3" services: filerepo: hostname: filerepo image: vcl6005:5000/teamcenter/file-repo:6.3.0 user: 0:0 deploy: mode: replicated replicas: 1 volumes: - /scratch/msf/filerepo:/fms/fsc/volume #@#logging: #@# driver: fluentd #@# options: #@# fluentd-address: 0.0.0.0:24223 #@# fluentd-async-connect: 'true' #@# tag: 'javamld.{{.Name}}.{{.ID}}' environment: - ARGS=-Deureka.serviceUrl.default=http://eureka:8080/eureka/v2/ -Dsecrets_path=../../run/secrets/ -DdispatcherUrls=https://vcl6005.net.plm.eds.com:9090/ - MEM_ARGS= -Xmx2048m -Xss228k -Djavax.net.ssl.trustStorePassword=private -Djavax.net.ssl.trustStore=/run/secrets/trust_store_file_name.p12 -Djavax.net.ssl.trustStoreType=pkcs12 secrets: - tc_micro_security.properties - validator_keystore.p12 - signer_tc_micro_security.properties - signer_keystore.p12 - trust_store_file_name.p12 depends_on: - eureka secrets: tc_micro_security.properties: file: ./secrets/tc_micro_security.properties validator_keystore.p12: file: ./secrets/validator_keystore.p12 signer_tc_micro_security.properties: file: ./secrets/signer_tc_micro_security.properties signer_keystore.p12: file: ./secrets/signer_keystore.p12 trust_store_file_name.p12: file: ./secrets/trust_store_file_name.p12 To update a running container image, deploy the updated ChangeMeServiceName microservice configuration (YAML) file. Google Online Office Online Copy your self-signed certificate in PEM format to the appropriate location depending on the host operating system. For this operating system Use this location Red Hat /etc/pki/ca-trust/source/anchors Suse /usr/share/pki/trust/anchors/ Install the certificate on the host operating system. For this operating system Run this command Red Hat update-ca-trust Suse Copy sudo update-ca-certificates To verify that the certificate is installed, run the command trust list and check that your certificate is in the list. Run the trust utility to generate a ca bundle file. Copy sudo trust extract --filter=certificates --format=pem-bundle /location/to/tcroot/microservices/container/secrets/tls-ca-bundle.pem Command Prediction Product Configurator Service reqexportservice reqimportservice Teamcenter Share (Source code language: C#) Copy your self-signed certificate in PEM format to the appropriate location depending on the host operating system. For this operating system Use this location Red Hat /etc/pki/ca-trust/source/anchors Suse /usr/share/pki/trust/anchors/ Install the certificate on the host operating system. For this operating system Run this command Red Hat update-ca-trust Suse Copy sudo update-ca-certificates To verify that the certificate is installed, run the command trust list and check that your certificate is in the list. Run the trust utility to generate a ca bundle file. Copy sudo trust extract --filter=certificates --format=pem-bundle /location/to/tcroot/microservices/container/secrets/tls-ca-bundle.pem Edit each microservice configuration file (YAML) to include a config object for the updated CA certs file. Replace occurrences of ChangeMeServiceName with the microservice name. To update a running container image, deploy the updated ChangeMeServiceName microservice files.