Run App Gateway in SSL Mode on Port 443

You can configure App Gateway to run in SSL mode on port number 443.

Note:

To run your App Gateway server in Secure Sockets Layer (SSL) mode, you need to have an valid certificate.

Configure App Gateway in Identity Cloud Service console

Update your App Gateway configuration to enable the server to listen on port number 443 and in Secure Sockets Layer (SSL) mode.

  1. Sign in to Oracle Identity Cloud Service console, expand the Navigation Drawer, click Security, click App Gateways, and then click the name of your App Gateway..
  2. In the Hosts tab, click the name of the host you created.
  3. in the Edit Hosts window, update the following parameters as per the example below:
    Parameter Value
    Port 443
    SSL Enabled Selected.
    Additional Properties
    ssl_certificate /scratch/myappgateway.example.com.cert;
    ssl_certificate_key /scratch/myappgateway.example.com.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!MD5;

    Note:

    You need to generate a valid certificate to be used as the SSL certificate. The certificate file (myappgateway.example.com.cert) and the certificate key file (myappgateway.example.com.key ) are referenced as an example.
  4. Click Save.

Configure the App Gateway Server

Execute the following procedure to enable your App Gateway server to run on port 443 in SSL mode.

Note:

Generate a valid certificate to your App Gateway to run on SSL mode, and copy the certificate file and the certificate key file to your desktop.
  1. Use a SSH client such as PuTTY to log in to the App Gateway server.
  2. Execute the following commands to update a privileged user.
    sed -i "s/touch \$source_log/touch \$source_log \&\& chown \$NGINX_USER:\$NGINX_USER \$source_log/g" /scratch/oracle/cloudgate/ova/bin/jobs/manage-logs.sh 
    sudo sed -i "s/ oracle / root /g" /etc/cron.d/cloudgate-jobs 
    sudo sed -i "s/sudo -u oracle//g" /etc/init.d/cloudgate-nginx 
    sudo sed -i "s/sudo -u oracle//g" /etc/init.d/cloudgate-agent
  3. Execute the following commands to change permission of the folders.
    sudo chmod -R 755 /scratch/
    sudo chown root:root /scratch/oracle/cloudgate/home/bin/nginx
    cd /usr/local/nginx/sbin/
    rm nginx
    sudo ln -sf /scratch/oracle/cloudgate/home/bin/nginx
  4. Copy the certificate file (for example, myappgateway.example.com.cert) and the certificate key file (for example, myappgateway.example.com.key) from your desktop to the /scratch/ folder.
  5. Add user oracle to the nginx.conf file by executing the following command.
    sudo sed -i "/working_directory.*/a user oracle;" /usr/local/nginx/conf/nginx.conf
  6. Edit the /scratch/oracle/cloudgate/ova/bin/setup/cloudgate-env file. You can use the following command or any other text editor of your choice: vi /scratch/oracle/cloudgate/ova/bin/setup/cloudgate-env
  7. Replace the value of the CG_CALLBACK_PREFIX parameter with the following https://%hostid%
  8. Save the /scratch/oracle/cloudgate/ova/bin/setup/cloudgate-env file.
  9. Run the following sed commands to enable running the server with sudo command:
    sed -i s/verify_running_as_user/#verify_running_as_user/g /scratch/oracle/cloudgate/ova/bin/setup/setup-cloudgate
    sudo sed -i "/create_wallet || .*/a chmod -R 755 /scratch/oracle/cloudgate/wallet/" /scratch/oracle/cloudgate/ova/bin/setup/setup-cloudgate
  10. Confirm the setup-cloudgate file is configured with the values of your Oracle Identity Cloud Service tenant, and the values of the Client IDand Client Secret of the App Gateway you registered in Oracle Identity Cloud Service console.
  11. Run the following command to reconfigure App Gateway according to the parameters registered in the Oracle Identity Cloud Service console (in this case, port number 443 and SSL Enabled.
    sudo -E /scratch/oracle/cloudgate/ova/bin/setup/setup-cloudgate
After the setup-cloudgate script finishes, the App Gateway server starts automatically. You can access any application protected by your App Gateway using HTTPs, App Gateway domain, and port number 443 (default HTTPs port). For example, https://myappgateway.example.com/myapp/index

Start and Stop App Gateway Server Using sudo Command

Because you set up your App Gateway server to run on port 443, you need to start and stop App Gateway server and agent using sudo command.

  1. To stop the App Gateway server and agent use the following command:
    sudo -E /scratch/oracle/cloudgate/home/bin/cg-stop
    sudo -E /scratch/oracle/cloudgate/home/bin/agent-stop
    
  2. To start the App Gateway server and agent use the following command:
    sudo -E /scratch/oracle/cloudgate/home/bin/cg-start
    sudo -E /scratch/oracle/cloudgate/home/bin/agent-start