Configure TLS

TLS can be configured on the RTP Proxy, the MFE, and the IAC.

Configure TLS for the RTP Proxy

1. Copy the public key of the Converged Application Server to the /opt/ORACLE_HOME/config/security/ directory of each RTP Proxy VM.
2. SSH to the RTP Proxy VM.
3. Elevate your privileges to root.
4. Navigate to the security directory.

   cd /opt/ORACLE_HOME/config/security/

5. Remove the existing certificate.

   rm public.pem server.p12

6. Create a new self-signed keystore with your RTP Proxy in the SAN field.

   keytool -genkeypair \
     -alias 1 \
     -keyalg RSA \
     -keysize 2048 \
     -validity 365 \
     -keystore server.p12 \
     -storetype PKCS12 \
     -storepass <password> \
     -dname "CN=<PRIMARY_IP>, O=<YOUR_ORG>, L=<CITY>, ST=<STATE>, C=<COUNTRY_CODE>" \
     -ext "SAN=IP:<PRIMARY_IP>,IP:<SECONDARY_IP>,DNS:localhost"

7. Verify the key store has stored the certificate.

   keytool -list -keystore server.p12 -storetype PKCS12 -storepass <password>

8. Export the certificate to a file called server.crt.

   keytool -exportcert \
     -alias 1 \
     -keystore server.p12 \
     -storetype PKCS12 \
     -storepass <password> \
     -file server.crt \
     -rfc

9. Create the client trust store by importing the certificate file.

   keytool -importcert \
     -file server.crt \
     -alias 1 \
     -keystore client-truststore.jks \
     -storepass <password> \
     -noprompt

10. Copy the client-truststore.jks file to the Oracle_Home directory of the Converged Application Server.

    For example:

    scp client-truststore.jks oracle@<IP-address>:Oracle/Middleware/Oracle_Home/

11. Set the Controller.tls.enabled property to true.
12. Open the /opt/ORACLE_HOME/systemd/rtp-proxy-controller.env file and set the following environmental variables:
    • TLS_KEY_ALIAS
    • TLS_KEYSTORE_PASSPHRASE
    • TLS_KEY_PASS
13. If you have previously installed the systemd service for RTP Proxy, re-run the installation script to apply your updates.

    ./install-systemd.sh

14. SSH to your Converged Application Server.
15. If you have an existing truststore file, merge the two files into one truststore.

    keytool -importkeystore \
      -srckeystore <source-truststore.jks> \
      -srcstorepass <password> \
      -destkeystore client-truststore.jks \
      -deststorepass <password> \
      -srcstoretype JKS \
      -deststoretype JKS \
      -noprompt

    You can validate the process worked with the command:

    keytool -list -keystore client-truststore.jks

16. Edit the <Domain_Home>/bin/setDomainEnv.sh file to add the truststore file to the SAVE_JAVA_OPTIONS parameter.

    SAVE_JAVA_OPTIONS="${JAVA_OPTIONS} \
      -Djavax.net.ssl.trustStore=${ORACLE_HOME}/client-truststore.jks \
      -Djavax.net.ssl.trustStorePassword=<password> \
      -Djavax.net.ssl.trustStoreType=JKS"

17. Restart the Admin Server and Managed Servers.

The RTP Proxy will serve the certificate loaded from server.p12, and the Converged Application Server will trust the certificate.

Configure TLS for the MFE

Follow these steps to enable TLS for the MFE.

1. Connect to the VM where you installed the MFE.
2. Navigate to the MFE's config directory.

   cd media-flow-engine-8.3.0.0.0-MFE/MFE_HOME/config/

3. In the application.yaml file, set the server.tls.enabled property to true.

   server:
     http-port: 8080
     https-port: 8443
     tls:
       enabled: true
       client-auth: "NONE"
       protocols: [TLSv1.3, TLSv1.2]

Configure TLS for the IAC

Follow these steps to enable TLS for the IAC.

1. Connect to the VM where you installed the IAC.
2. Navigate to the IAC's config directory.

   cd IntelligentAIConnector-8.3.0.0.0-AIC/AIC_HOME/config/

3. In the application.yaml file, set the server.tls.enabled property to true.

   server:
     http-port: 8080
     https-port: 8443
     tls:
       enabled: true
       client-auth: "NONE"
       protocols: [TLSv1.3, TLSv1.2]