To establish Octopus Authentication Nginx communications on a secure tunnel, Secret Double Octopus recommends enforcing a root-CA certificate, thus assuring an SSL connection with the Octopus Authentication Server.

The Octopus Authentication Server supports the following Nginx engines:

Web Nginx for SAML web services
Octopus Authentication Management Nginx

Prerequisites

Before you begin, verify that the Octopus Authentication Server's hostname is running FQDN:

# hostnamectl set-hostname OctopusAuthenticationFQDN.com --static

SSL Certificate for Octopus Authentication Nginx

The SSL certificate allows access to Octopus Authentication’s Nginx web engine through an encrypted secured connection. TLS/SSL works by using a combination of a public certificate and a private key:

The SSL key is kept a secret on the server. It is used to encrypt content sent to clients.
The SSL certificate is publicly shared with anyone requesting the content. It can be used to decrypt the content signed by the associated SSL key.

Approved SSL vendors can issue validated SSL certificates.

The following sections describe how to create and configure the SSL certificate. If you have already done this, skip to the instructions for replacing the certificate (at the end of this article).

Creating the OpenSSL Config File and Generating the CSR

By default, the OpenSSL does not include an alternate subject name (which is required for verification on Chrome browse v58 and up). To create a certificate that includes the alternate subject name, a config file has to be created and used when requesting the certificate.

Create a config file named (for example) san.cnf with the following information:

[ req ]
default_bits = 2048
distinguished_name = req_distinguished_name
req_extensions = req_ext
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
stateOrProvinceName = State or Province Name (full name)
localityName = Locality Name (eg, city)
organizationName = Organization Name (eg, company)
commonName = Common Name (e.g. server FQDN or YOUR name)
[ req_ext ]
subjectAltName = @alt_names
[alt_names]
DNS.1 = <server FQDN>

After creating the file, generate a certificate signing request (CSR):

# sudo openssl req -new -newkey rsa:2048 -nodes -config san.cnf -keyout selfsigned.key -out selfsigned.csr

You will be asked to enter the certificate information that will be incorporated into your certificate request. Please use only alphanumeric characters when completing the details.

To verify that the CSR file contains the alternate subject name, run the following:

openssl req -noout -text -in selfsigned.csr | grep DNS

SSL Certificate Activation

Next, use the CSR file to submit a request for corporate SSL certificate activation (CA Authority validation):

1. Submit the SSL Certification Request: Open the Certificate Signing Request (CSR) file with the text editor, copy its content together with the header “-----BEGIN CERTIFICATE REQUEST-----" and footer “-----END CERTIFICATE REQUEST-----" and use it to activate the certificate in your corporate’s Certificate Authority account.

2. Sign with MS CA: On your domain machine, open the command line as an admin and run the following:

certreq -submit -attrib "CertificateTemplate:webServer" selfsigned.csr selfsigned.cer

Installing and Configuring Your SSL Certificate

Following certificate activation, you will receive your issued Domain-Name Certificate pem file (server.crt). This file contains the Primary Root CA certificate (ca.crt) file and the Intermediate certificate.

For a valid Nginx SSL Certificate, you need to concatenate your Bundle certificate together with your Obtain certificate into a single unified .crt file (e.g., selfsigned.crt):

# cat server.crt ca.crt > selfsigned.crt

Then perform the following steps:

As a root user, copy the certificate and the key to the nginx folder:

# cp selfsigned.crt /etc/pki/nginx/
# cp selfsigned.key /etc/pki/nginx/private/

Restart the server:
```
# sudo systemctl restart nginx
```
Perform a sanity check:
```
# sudo nginx -t
```

Verifying Octopus Authentication Nginx Encryption

To check for successful encryption, open your web browser and enter the following in the address bar:
https:// <Octopus Authentication Server domain name>

Verify that the page loads with no security warning.

Replacing the SSL Certificate

Steps for Management Console Servers:

Navigate to cd /etc/nginx/conf.d/ and run the following command:
```
cat sdomcbe.conf
```

Check the server path. Be sure to create a copy of all the files before editing them.

ssl_certificate /etc/pki/nginx/server_certificate_for_example.crt;
ssl_certificate_key /etc/pki/nginx/private/server_certificate_key_for_example .key;

Change the owner of the new files to sdo:

cd /etc/pki/nginx/
chown sdo:sdo server_certificate_for_example.crt
cd /etc/pki/nginx/private/
chown sdo:sdo server_certificate_key_for_example .key

Restart the server:
```
systemctl restart nginx sdomcbe
```

Steps for Authentication Servers and DMZ Servers:

Navigate to cd /etc/nginx/conf.d/sdomon.conf and run the following command:
```
cat sdomon.conf
```