Securing connections on WFM servers
The Transport Layer Security (TLS) configuration for WFM servers (except WFM Web and Daemon) adhere to the common guidelines in the Genesys Security Deployment Guide as they apply to deployment on Windows platforms. However, there are couple of limitations:
- The certificate can only be assigned at the Host object level.
- To enable mutual authentication on the WFM server, you must add the MutualAuth = true configuration option to the Application properties.
WFM Web and Daemon
Neither WFM Web nor WFM Daemon adhere to the common guidelines in the Genesys Security Deployment Guide for TLS configuration. WFM Web uses PSDK libraries, which enable secure connections to Genesys Configuration Server. WFM Web also supports secure connections to other WFM servers.
To use secure connections, you must import certificates that use the Java Runtime Environment (JRE) trusted certificates store. Use the keytool utility that is provided by Java and described in Key and Certificate Management Tool.
| Connections from/to: | Description |
|---|---|
| WFM Web client to WFM Web server | The WFM Web client runs in a browser which must be configured to use TLS.
|
| WFM Web and Daemon to WFM Web server, report engine | WFM Web server runs in a servlet container. Therefore, the secure connection options must be configured in the appropriate servlet container.
|
| WFM Web and Daemon to other WFM servers | WFM Server, WFM Builder, and WFM Data Aggregator must be configured to work in secured mode. When that is done, Web and Daemon automatically detect the settings and use secure connections. Some additional development is required to ensure WFM servers recognizes the secure connections settings.
|
| WFM Web to Genesys Management Framework components | To successfully implement secure connections to Genesys Management Framework components (Configuration Server, Message Server, Local Control Agent, and other configuration and management components), WFM Web and Daemon must be switched to use Genesys Platform SDK libraries that support this functionality. This switch affects all interactions with above mentioned Genesys servers and must be thoroughly tested.
|
Securing connections to Genesys Configuration Server
Purpose: To enable secure connections to Genesys Configuration Server.
Start procedure
- Import the Genesys Configuration Server certificates for host and port (depending on configuration) that use JRE's trusted certificates store.
- Configure Configuration Server to run its listening port in Auto Detect mode.
- Turn on Configuration Server logging.
- Run WFM Daemon.
- WFM Daemon connects to Configuration Server and communication is established.
- Check the Configuration Server logs.
- The logs indicate that WFM Daemon connected successfully and the connection is elevated to secure status.
End Procedure
Securing connections to WFM servers
Purpose: To enable secure connections from WFM Web and WFM Daemon to WFM servers.
Start procedure
- Import the certificates for the WFM <server> host and port that use JRE's trusted certificates store.
- Configure the WFM <server> to run its listening port in Secure mode.
- Run WFM Daemon.
- WFM Web and WFM Daemon connect to the WFM <server> and communication is established. (There is no connection from WFM Daemon to WFM Server.)
- Check the WFM <server> logs for returned references to its services using HTTPS.
- Alternatively, use a network sniffing utility to ensure that traffic between Web and WFM <server> is scrambled.
End Procedure
FIPS support
To enable Federal Information Processing Standard (FIPS) support for Java-based WFM Web and Daemon, Java version 6 or higher is required. See the following resources:
- Using NSS for FIPS 140-2 compliant transport security in CXF
- Network Security Services (NSS) on Mozilla.org
Securing connections on Java for WFM Web and Daemon to other servers
WFM Web and Daemon Java applications use several different components to connect to other WFM and Genesys servers. All of them use the same Java services for Secure Socket Layer (SSL) connections. Therefore, SSL is configured the same way for all components. For WFM components, Genesys recommends you configure SSL on the application or JRE level. There are several ways to do this, some of which are discussed below.
Using Microsoft Cryptography Provider
When using Microsoft Cryptography Provider, Java applications use the same native Windows cryptography as the WFM servers. Using this configuration is advantageous, as some of the steps can be done in the same way as they would be done for other WFM servers, such as WFM Builder, WFM Server, and WFM Data Aggregator, but this configuration works only on Windows, and only with Java 6 32-bit version. (It might work if you are running Java 32-bit on Windows 64-bit platforms, but does not work if you are using Java 64-bit.)
Enabling security using Microsoft Cryptography Provider
Purpose: To enable security on WFM servers using Microsoft Cryptography Provider
Start procedure
- Configure Genesys Configuration Server, WFM Server, and any other WFM servers involved in the test with secure connections.
- This configuration requires you to install certificates on hosts that run these servers.
- Attempt to run WFM Java applications and connect to secure WFM Server. The attempt should fail.
- Install certificates on hosts running WFM Java applications. Specify the following Java JRE options for WFM Java applications:
- -Djavax.net.ssl.keyStoreProvider=SunMSCAPI
- -Djavax.net.ssl.keyStoreType=WINDOWS-MY
- -Djavax.net.ssl.trustStoreProvider=SunMSCAPI
- -Djavax.net.ssl.trustStoreType=WINDOWS-ROOT
- These options take effect, depending on how the appropriate application runs. For example
- Configure WFM Web to run the TOMCAT_HOME\bin\tomcatw.exe utility . Click the Java tab and paste the above strings into Java Options. Remember to add Enter after last line. The options take effect after the Tomcat service restarts.
- For WFM Daemon service, launch regedit and find the HKEY_LOCAL_MACHINE\SOFTWARE\Apache Software Foundation\Procrun 2.0\WFMDaemon\Parameters\Java key. Then, find Options and add the above strings. You must enter each option on a new line and add Enter after the last option. The options take effect after the Daemon service is restarted.
- The Java applications now successfully connect to WFM Server and work as expected.
End procedure
The advantage of using this configuration, at least theoretically, is that you can set the Microsoft Cryptography provider so that it is FIPS-compliant, which covers the requirements for FIPS support.
Using JRE Security Provider
This configuration method uses the native Java Security Provider, which works on Java version 5 and later (32- and 64-bit) and on supported operating systems. However, the configuration has more steps. You will make extensive use of the keytool.exe located in the JAVA_HOME\bin directory and use Java 6 SDK (not JRE) in the following steps:
Enabling security using JRE Security Provider
Purpose: To enable security on WFM servers using JRE Security Provider.
Start procedure
- Configure Genesys Configuration Server, WFM Server, and any other WFM servers involved in the test as secured.
- This configuration requires you to install certificates on hosts that run these servers.
- Attempt to run WFM Java applications and connect to secure WFM Server. The attempt should fail.
- Obtain the certificates used to secure WFM Server and other servers.
- In this procedure, we assume the certificates file extension is of type .p12, but it might not be.
- Using following command, convert the certificate format to one that is used by Java applications:
- keytool.exe -importkeystore -srckeystore inputkeystore.p12 -srcstoretype pkcs12 -srcstorepass password -destkeystore outputkeystore.jks -deststoretype jks
- Where
- inputkeystore.p12—Is the original file with certificates
- password—Is the password provided for original file
- outputkeystore.jks—Is the output file containing certificates in Java format
- Check that you have successfully converted certificates using following command:
- keytool.exe -list -keystore outputkeystore.jks -v
- Export the certificate file that will be imported to target Java and run on WFM applications:
- keytool.exe -exportcert -keystore outputkeystore.jks -alias alias -file certificate
- Where
- certificate—Is the name of file that will contain exported certificate, can be anything
- alias—Is he name of certificate in Java's certificate storage. It can be determined by looking at the output of command from step #3.
- Check that the exported certificate is ok:
- keytool.exe -printcert -file certificate -v
- Now that you have the certificate, import it to Java and run in on the WFM applications:
- keytool.exe -import -alias alias -file certificate -keystore "%JAVA_HOME%\jre\lib\security\cacerts" -storetype jks -storepass changeit -v
- Where
- %JAVA_HOME%—Is the variable that points to the Java installation root. You can substituted this with the actual path to the installation root.
- Check that the certificate was successfully imported and is present:
- keytool.exe -list -alias alias -keystore "%JAVA_HOME%\jre\lib\security\cacerts" -storetype jks -storepass changeit -v
- If you need to remove the imported certificate, use following command:
- keytool.exe -delete -alias alias -keystore "%JAVA_HOME%\jre\lib\security\cacerts" -storetype jks -storepass changeit -v
- After performing steps #4 to #9, restart the WFM Java application.
- Ensure it connects successfully to WFM Server or other servers and works as expected using secured connections.
Securing Tomcat and Web
Securing Tomcat is fairly simple. The details are provided in SSL/TLS Configuration HOW-TO.
Enabling security for Tomcat and Web
Purpose: To enable security for Tomcat and WFM Web.
Start procedure
- Obtain certificates from Genesys System Team for the host that will run secured Tomcat.
- Convert the certificate file format to .jks format. See step #4 in Using JRE Security Provider.
- Edit the file TOMCAT_HOME\conf\server.xml by uncommenting the section for secure connector and updated it to:
- <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
- maxThreads="150" scheme="https" secure="true"
- keystoreFile="path/to/my/keystore.jks" keystorePass="genesys"
- clientAuth="false" sslProtocol="TLS" />
- Import the certificates for hosts running other WFM servers into the Java servlet that runs Tomcat.
- See the description above. If you do not complete this step, WFM Web cannot connect to other WFM servers.
- Restart Tomcat and and connect to port 8443 (instead of usual 8080), specifying HTTPS.
- If a browser message about a bad host name displays, enter the Fully Qualified Domain Name (FQDN).
- Make sure it is the same one for which the certificate was issued.
- Log in as an agent.
- Ensure everything is working as expected.
- Log in as a supervisor.
- Import the first certificate, used to secure Tomcat, in Java that runs the applet.
- It's likely different from the one that runs Tomcat.
- Follow steps above.
- If the applet comes up, but is gray and the console log contains SSL errors, the certificate is not correctly imported.
End procedure
After the procedure is completed, Daemon will connect successfully to Web using secured connections. Note that you must import the certificate for secured WFM Web to the Java that runs Daemon, in addition to the certificates for other WFM and Genesys servers.