TLS Encryption with CA

---

Configure the Authentication

Follow these instructions:

• Purchase the TLS Certificates

• Configure the Authentication for SEAL Print Client

• Configure the Authentication for Consul

• Configure the Authentication for MongoDB

• Restart SEAL Print Client

---

Purchase the TLS Certificates

1. Purchase a TLS certificate in PEM format for each server. This certificate has to contain the following entries:

   • localhost

     • For local connections on a server.

   • SEAL Print Client server name

     • For connections to Consul and MongoDB

   • Consul-specific server name

     • For connections between the SEAL Print Client services

   Hint - TLS certificates

   All TLS certificates have to be signed by the same Certificate Authority (CA).

2. Replace the following file by the private key:

   • /opt/seal/infrastructure/config/tls/key.pem

3. Replace the following file by the signed public certificate:

   • /opt/seal/infrastructure/config/tls/cert.pem

4. Save the CA's certificate in the following file:

   • /opt/seal/infrastructure/config/tls/ca.pem

---

Configure the Authentication for the SEAL Print Client Services

1. Set the key TLS_DIR to the following path:

   • TLS_DIR: /opt/seal/infrastructure/config/tls

---

Configure the Authentication for Consul

1. Open the Consul configuration file:

   • /opt/seal/infrastructure/config/consul.json

2. Insert the following lines in the second line after the opening brace:

       "ca_file": "/opt/seal/infrastructure/config/tls",
       "verify_outgoing": true,
   

Caution - structure

The Consul configuration file is a JSON object whose structure has to be retained! For further information, refer to http://json.org/json-de.html.

---

Configure the Authentication for MongoDB

1. Open the MongoDB configuration file:

   • /opt/seal/infrastructure/config/mongod.conf

2. Search the following line:

   • allowInvalidCertificates: true

3. Replace the line by:

   • CAFile: /opt/seal/infrastructure/config/tls/ca.pem

---