UI Communications Certificate Updates
- Nick Judson
This change prevents older versions of UIs from connecting to 16.1R3. The new UI versions can connect to older 16.1 servers.
Prior to 16.1R3, communications between UIs and servers used TLS with a self-signed, self-installed certificate. Starting in 16.1R3, the TLS certificate used for UI-server communications can be selected from the local-machine certificate store. This allows the use of a trusted, 3rd-party certificate should you wish to fully validate communications within your private network (or across VPNs).
For Connexion, a new field has been added to the Configuration Wizard.
Leaving the certificate field blank will install a self-signed certificate with the name ConnexionV16.<HostName>. This is the same behavior as previous versions, although the self-signed certificate name has been updated.
The first time a connection is established with a Connexion service, the UI will validate the certificate and present the end-user with the service certificate information. The end-user can inspect the certification information and choose to accept or reject it. Note that when a UI is running on the same host as the service, the connection is automatically accepted without user intervention.
The certificate specified is used for UI ↔︎ service communications, API communications (if enabled), and Metrics communications (if enabled).
The certificate in use by a service can be viewed on the Servers screen:
Similar functionality has been added to the Gateway. The primary difference between Connexion and Gateway configuration is the gateway does not allow you to specify a specific certificate for UI-service communications. It uses the certificate specified for remote integrator ↔︎ gateway communications.
The gateway UI will prompt for certificate acceptance in the same manner as the Connexion UI.