-
-
Notifications
You must be signed in to change notification settings - Fork 41
Setting up secure HTTP with AMP
There are a number of methods that can be used to set up secure HTTP (HTTPS) within AMP depending on your use case.
Note that with AMP Enterprise, use of HTTPS is mandatory.
If you use the default GetAMP.sh setup script, this is handled for you automatically. If you need to do this after the fact, then you simply run the following as root:
ampinstmgr setupnginx my.domain.com 8080
Where 8080 is the port that ADS is currently bound to. This will automatically configure nginx and run certbot to secure the domain. Before running the command ensure that the packages nginx, certbot and python-certbot-nginx are installed, otherwise the command will fail.
Also, you need port 80 forwarded and allowed through any firewall for certbot to be able to install the certificate. And of course port 443 must be forwarded and allowed through any firewall to access AMP externally via HTTPS, when this method is used.
AMP has built in support for HTTPS with its internal application server. AMP requires a certificate in PFX format with a passphrase. You can use ampinstmgr convertcertificate to convert a standard .cert + .key file pair into a PFX on Linux systems.
The main advantage is that no additional software is required, however it's not suitable for use with LetsEncrypt as AMP has to be restarted to swap out the certificate.
This method is optimal if you already have your certificate in use with another webserver already.
Open /home/amp/.ampdata/instances/ADS01/AMPConfig.conf while ADS is stopped and edit the following lines:
Webserver.CertificatePath=/path/to/your/certificate.pfx
Webserver.CertificatePassword=y0urc0mplexpa5$word
Install the certificate to your system into the local machine store, and then view the certificate to get its serial number. Once you've done this edit the following lines to your AMPConfig.conf file for ADS:
Webserver.CertificateSerial=CERTIFICATESERIALNUMBERGOESHERE
When using AMP’s built in HTTPS support, all existing instances other than ADS01 will need their authentication server updated to your ADS installations new URL.
Your login section for AMPConfig.conf for each instance should look like this, make sure to change ads.somedomain.com to your chosen domain.
################################
# Login
################################
Login.UseAuthServer=True
# Login.AuthServerURL - The URL for the ADS instance providing authentication when using UseAuthServer
Login.AuthServerURL=https://ads.somedomain.com:8080/
Login.LDAPAllowAuthOnAnyDomain=False
Login.LDAPAuthDomain=
Where 8080 is the port that ADS is currently bound to. Also in ADS, under Configuration -> New Instance Defaults you need to update the Default Auth Server URL to be the new URL of your ADS installation.