Using SSL with Dispatcher using-ssl-with-dispatcher

Use SSL connections between Dispatcher and the render computer:

Use SSL When Dispatcher Connects to AEM use-ssl-when-dispatcher-connects-to-aem

Configure Dispatcher to communicate with the AEM or CQ render instance using SSL connections.

Before you configure Dispatcher, configure AEM or CQ to use SSL:

SSL-Related Request Headers ssl-related-request-headers

When Dispatcher receives an HTTPS request, Dispatcher includes the following headers in the subsequent request that it sends to AEM or CQ:

A request through Apache-2.4 with mod_ssl includes headers that are similar to the following example:

X-Forwarded-SSL: on
X-Forwarded-SSL-Cipher: DHE-RSA-AES256-SHA
X-Forwarded-SSL-Session-ID: 814825E8CD055B4C166C2EF6D75E1D0FE786FFB29DEB6DE1E239D5C771CB5B4D

Configuring Dispatcher to Use SSL configuring-dispatcher-to-use-ssl

To configure Dispatcher to connect with AEM or CQ over SSL, your dispatcher.any file requires the following properties:

Note: Create another virtual host for handling HTTP requests, if necessary.

The following example dispatcher.any file shows the property values for connecting using HTTPS to a CQ instance that is running on host localhost and port 8443:

/farms
{
   /secure
   {
      /virtualhosts
      {
         # select this farm for all incoming HTTPS requests
         "https://*"
      }
      /renders
      {
      /0001
         {
            # hostname or IP of the render
            /hostname "localhost"
            # port of the render
            /port "8443"
            # connect via HTTPS
            /secure "1"
         }
      }
     # the rest of the properties are omitted
   }

   /non-secure
   {
      /virtualhosts
      {
         # select this farm for all incoming HTTP requests
         "http://*"
      }
      /renders
      {
         /0001
      {
         # hostname or IP of the render
         /hostname "localhost"
         # port of the render
         /port "4503"
      }
   }
    # the rest of the properties are omitted
}

Configuring Mutual SSL Between Dispatcher and AEM configuring-mutual-ssl-between-dispatcher-and-aem

To use Mutual SSL, configure the connections between Dispatcher and the render computer (typically an AEM or CQ publish instance):

To configure mutual SSL, you require certificates that are signed by a trusted certificate authority (CA). Self-signed certificates are not adequate. You can either act as the CA or use the services of a third-party CA to sign your certificates. To configure mutual SSL, you require the following items:

To configure mutual SSL, perform the following steps:

Creating or Obtaining CA-Signed Certificates creating-or-obtaining-ca-signed-certificates

Create or obtain the CA-signed certificates that authenticate the publish instance and Dispatcher.

Creating Your CA creating-your-ca

If you are acting as the CA, use OpenSSL to create the Certificate Authority that signs the server and client certificates. (You must have the OpenSSL libraries installed.) If you are using a third-party CA, do not perform this procedure.

Creating the Certificates creating-the-certificates

Use OpenSSL to create the certificate requests to send to the third-party CA or to sign with your CA.

When you create a certificate, OpenSSL uses the Common Name property to identify the certificate holder. For the certificate of the render instance, use the instance computer’s host name as the Common Name if you are configuring Dispatcher to accept the certificate, and only if it matches the hostname of the Publish instance. (See the DispatcherCheckPeerCN property.)

Configuring SSL on the Render Computer configuring-ssl-on-the-render-computer

Configure SSL on the render instance using the rendercert.pem and renderkey.pem files.

Converting the Render Certificate to JKS (Java™ KeyStore) format converting-the-render-certificate-to-jks-format

Use the following command to convert the render certificate, which is a PEM file, to a PKCS#12 file. Also include the certificate of the CA that signed the render certificate:

Adding the CA Cert to the Render’s Truststore adding-the-ca-cert-to-the-render-s-truststore

If you are acting as the CA, import your CA certificate into a keystore. Then, configure the JVM that runs the render instance to trust the keystore.

Configuring the Render Instance configuring-the-render-instance

To configure the HTTP service of the render instance to use SSL, use the render certificate with the instructions in the Enable SSL on the Publish Instance section:

Configuring SSL for the Dispatcher Module configuring-ssl-for-the-dispatcher-module

To configure Dispatcher to use mutual SSL, prepare the Dispatcher certificate and then configure the web server module.

Creating a Unified Dispatcher Certificate creating-a-unified-dispatcher-certificate

Combine the Dispatcher certificate and the unencrypted private key into a single PEM file. Use a text editor or the cat command to create a file that is similar to the following example:

Specifying the Certificate to Use for Dispatcher specifying-the-certificate-to-use-for-dispatcher

Add the following properties to the Dispatcher module configuration (in httpd.conf):

The following code is an example configuration:

<IfModule disp_apache2.c>
  DispatcherConfig conf/dispatcher.any
  DispatcherLog    logs/dispatcher.log
  DispatcherLogLevel 3
  DispatcherNoServerHeader 0
  DispatcherDeclineRoot 0
  DispatcherUseProcessedURL 0
  DispatcherPassError 0
  DispatcherCertificateFile disp_unified.pem
  DispatcherCACertificateFile cacert.pem
  DispatcherCheckPeerCN On
</IfModule>