ÃÛ¶¹ÊÓƵ

Use SSL with Dispatcher using-ssl-with-dispatcher

Use SSL connections between the Dispatcher and the rendering computer:

Use SSL when Dispatcher connects to AEM use-ssl-when-dispatcher-connects-to-aem

Configure the Dispatcher to communicate with the AEM or CQ render instance using SSL connections.

Before you configure Dispatcher, configure AEM or CQ to use SSL. For further information see:

SSL-related request headers ssl-related-request-headers

When Dispatcher receives an HTTPS request, Dispatcher includes the following headers in the subsequent request that it sends to AEM or CQ:

A request through Apache-2.4 with mod_ssl includes headers that are similar to the following example:

X-Forwarded-SSL: on
X-Forwarded-SSL-Cipher: DHE-RSA-AES256-SHA
X-Forwarded-SSL-Session-ID: 814825E8CD055B4C166C2EF6D75E1D0FE786FFB29DEB6DE1E239D5C771CB5B4D

Configure Dispatcher to use SSL configuring-dispatcher-to-use-ssl

To configure Dispatcher to connect with AEM or CQ over SSL, your dispatcher.any file requires the following properties:

Note: Create another virtual host for handling HTTP requests, if necessary.

The following example dispatcher.any file shows the property values for connecting using HTTPS to a CQ instance that is running on host localhost and port 8443:

/farms
{
   /secure
   {
      /virtualhosts
      {
         # select this farm for all incoming HTTPS requests
         "https://*"
      }
      /renders
      {
      /0001
         {
            # hostname or IP of the render
            /hostname "localhost"
            # port of the render
            /port "8443"
            # connect via HTTPS
            /secure "1"
         }
      }
     # the rest of the properties are omitted
   }

   /non-secure
   {
      /virtualhosts
      {
         # select this farm for all incoming HTTP requests
         "http://*"
      }
      /renders
      {
         /0001
      {
         # hostname or IP of the render
         /hostname "localhost"
         # port of the render
         /port "4503"
      }
   }
    # the rest of the properties are omitted
}

Configure mutual SSL between Dispatcher and AEM configuring-mutual-ssl-between-dispatcher-and-aem

To use Mutual SSL, configure the connections between Dispatcher and the render computer (typically an AEM or CQ publish instance):

To configure mutual SSL, you require certificates that are signed with a trusted Certificate Authority (CA). Self-signed certificates are not adequate. You can either act as the CA or use the services of a third-party CA to sign your certificates. To configure mutual SSL, you require the following items:

To configure mutual SSL, perform the following steps:

Create or obtain CA-signed certificates creating-or-obtaining-ca-signed-certificates

Create or obtain the CA-signed certificates that authenticate the publishing instance and Dispatcher.

Create your CA creating-your-ca

If you are acting as the CA, use to create the Certificate Authority that signs the server and client certificates. (You must have the OpenSSL libraries installed.) If you are using a third-party CA, do not perform this procedure.

Create the certificates creating-the-certificates

Use OpenSSL to create the certificate requests to send to the third-party CA or to sign with your CA.

When you create a certificate, OpenSSL uses the Common Name property to identify the certificate holder. For the certificate of the render instance, use the instance computer’s host name as the Common Name if you configure Dispatcher to accept the certificate. Do this procedure only if it matches the hostname of the Publishing instance. See the DispatcherCheckPeerCN property.

Configure SSL on the render computer configuring-ssl-on-the-render-computer

Configure SSL on the render instance using the rendercert.pem and renderkey.pem files.

Convert the render certificate to JKS (Javaâ„¢ KeyStore) format converting-the-render-certificate-to-jks-format

Use the following command to convert the render certificate, which is a PEM file, to a PKCS#12 file. Also include the certificate of the CA that signed the render certificate:

Add the CA cert to the render’s Truststore adding-the-ca-cert-to-the-render-s-truststore

If you are acting as the CA, import your CA certificate into a keystore. Then, configure the JVM that runs the render instance to trust the keystore.