Set Up a Load Balancer for Orchestrator Clustering › NGINX Load Balancer › Secure Communication › Linux

Linux

Secure communication for NGINX requires SSL certificates (c2okey2.pem and c2ocert.pem files). Make sure you generate these files before you begin this procedure.

Follow these steps:

1. Navigate to the following folder

   nginx_install_dir/conf
   

   This folder contains nginx.conf file.

2. Open the nginx.conf file.
3. Provide the server block as follows to verify the standalone NGINX.

   server {
           listen       80;
           server_name  <LOADBALANCER_HOSTNAME>;
   location / {
                root   /usr/share/nginx/html;
                 index  index.html index.htm;
          }
   }
   

4. Save the file and close it.
5. Navigate to the following folder:

   nginx_install_dir/conf
   

   This folder contains secure-pam-server.conf file.

6. Open the secure-pam-server.conf file.
7. There are three code blocks that require editing for every node that you add. Edit the blocks according to your security measures.
   1. Add the node1 host name in the upstream loadbalancer block:

      server <Enter node1 hostname here>:8443 max_fails=3 fail_timeout=3s
      

   2. Add the node1 host name under the upstream jettyloadbalancer block.

      server <Enter node1 hostname here>:8443 max_fails=3 fail_timeout=3s
      

   3. Add the node1 host name under the Define node1 block:

      server <hostname of machine where you have installed node1>:<jetty server port> max_fails=3 fail_timeout=3s
      

   Replace the Enter node1 hostname here placeholders with a valid value. Do not change the port numbers unless you use a different port for the CA Process Automation node.

   Note: The valid values are the IP address, the FQDN, or the DNS alias that resolves to the host where you are installing the initial Domain Orchestrator node. The valid value is the same value that is used for “Server Host” when installing the Domain Orchestrator.

   Repeat these steps for each additional node that you install.

8. Update the following lines by specifying the location of c2ocert.pem and c2okey2.pem files (in the nginx_installed_location\conf directory).

   ssl_certificate      <certificate_location\c2ocert.pem>;
   

   ssl_certificate_key  <certificate_location\c2okey2.pem>;
   

   For example:

   ssl_certificate      <nginx_install_dir\conf\c2ocert.pem>;
   

9. Save and close the secure-pam-server.conf file.
10. Open the nginx.conf file.
11. Add the following entry in the http block at the end of nginx.conf file:

    include nginx_install_dir/conf/secure-pam-server.conf;
    

    This entry links NGINX with the configuration changes you made for CA Process Automation in the secure-pam-server.conf file.

12. Remove the following entry from:

    include nginx_install_dir/nginx/conf.d/*.conf;
    

13. Save and close the nginx.conf file.

    Important! Perform the rest of these steps after you install at least one Orchestrator node. See Interactive Domain Orchestrator Installation or Unattended Domain Orchestrator Installation for instructions.

14. Once you have installed at least one Orchestrator node, open the nginx_install_dir/conf/nginx.conf file.
15. Remove any server blocks of code as they can conflict with the server identified in the secure-pam-server.conf file.

    For example:

    server {
            listen       80;
            server_name  <LOADBALANCER_HOSTNAME>;
    location / {
                 root   /usr/share/nginx/html;
                  index  index.html index.htm;
           }
    }
    

16. Save and close the nginx.conf file.
17. Restart NGINX. In a command prompt, enter:

    service nginx  restart
    

    The changes take effect.