SSL Setup in Zephyr

Please be aware that this material is provided for your information only and using it is done so at your own risk. Zephyr has taken care that all the information contained here is correct and complete, but it is impossible to ensure this is the case. The documentation represents two generic scenarios for implementing SSL, and doesn't take into consideration any unique characteristics of your own server and network setup. Decisions made by your company regarding the security of your data via an implementation of SSL should be based on the understanding that even a correct SSL deployment will inherit any limitations of the technology and that it cannot protect against unknowns such as general human error. Zephyr cannot be held liable for any downtime or security breaches that may result from the use this document.

Why should you run Zephyr over SSL or HTTPS?

When web applications are being accessed across the internet, there is always the possibility of usernames and passwords being intercepted by intermediaries between your computer and the ISP/company. It is often a good idea to enable access via HTTPS (HTTP over SSL) and make this a requirement for pages where passwords are sent. Note, however, that using HTTPS may result in slower performance.

This document includes example instruction sets for SSL configurations which can be used to secure Zephyr's traffic.

Deployment Options:

Zephyr's underlying application server platform is Apache Tomcat. Apache Tomcat options for SSL configuration: Java (JSSE) .This requires a set of keys and certificates. JSSE generally uses a JKS (Java) keystore.

Java (JSSE): A JKS certificate can be used to cover both traffic channels.

Deployment Prerequisites:

While using Java JSSE method, then all you need a JKS (Java keystore) certificate. Use your Java keytool to create a certificate and have it signed by a CA (certification authority), or create a self-signed certificate.

In order to make Zephyr's communication secure there are two locations to make changes inside the Zephyr installation directory. These locations define our HTTP communication, where changes can be made to switch to HTTPS . The changes are needed in the server.xml file and in the jdbc.properties file.

This is the main configuration file of Tomcat. You will be converting HTTP to HTTPS.

<!--
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol
"maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
clientAuth="false" sslEnabledProtocols="TLSv1.2" sslProtocol="TLS" /> -->

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true"
acceptCount="100"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslEnabledProtocols="TLSv1.2" sslProtocol="TLS"
keystoreFile="C:/Program Files/Zephyr/tomcat/conf/yzstore.jks" keystorePass="changeit" />

This is the Zephyr file responsible for defining all the communication channels used by Zephyr and its clients. You will be converting non-secure to secure. The jdbc.properties file can only work with Java JKS certificate format.

Locate the following section:

jdbc.properties

Needed by services-config.xml
secured=false
<!-- Provide correct keystore.file, keystore.password and keystore.alias if secured property is true-->
keystore.file=
keystore.password=
keystore.alias=

Make the following edits to it:

jdbc.properties

Needed by services-config.xml
secured=true
<!-- Provide correct keystore.file, keystore.password and keystore.alias if secured property is true-->
keystore.file=c:/progra~1/zephyr/tomcat/conf/yzstore.jks
keystore.password=changeit
keystore.alias=yz

For any questions regarding this document, please contact Zephyr Support.