You may optionally configure an SSL certificate to secure connections to the web application of the Designer Cloud powered by Trifacta® platform .
NOTE: For security reasons, a self-signed certificate is considered an insecure origin by most browsers, which do not cache results from these origins. As a result, each user visit to the Designer Cloud application requires re-downloading of static assets from the application. For better performance, you should consider deploying a signed certificate. Low-cost solutions such as Let's Encrypt can be deployed to manage your certificates on the Trifacta node.
A valid SSL certificate for the FQDN where the Designer Cloud application is hosted
Tip: Your certificate should be created using 2047-bit or larger keys. In some environments, such as RHEL 8.x, 1024-bit encryption is no longer accepted per default cryptographic policies.
- Root access to the Trifacta server
- Designer Cloud powered by Trifacta platform is up and running
There are two separate Nginx services on the server: one service for internal application use, and one service that functions as a proxy between users and the Designer Cloud application . To install the SSL certificate, all configuration are applied to the proxy process only.
NOTE: Do not apply these configuration changes to the nginx files in
/opt/trifacta/conf. Those files apply to the internal nginx server, which is not covered by SSL.
Log into the Trifacta server as the centos user. Switch to the root user:
Enable the proxy nginx service so that it starts on boot:
Create a folder for the private key and limit access to it:
Copy the following files to the server. If you copy and paste the content, please ensure that you do not miss characters or insert unwanted characters.
.keyfile should go into the
The .crt file and the CA bundle/intermediate certificate bundle should go into the
NOTE: The delivery name and format of these files varies by provider. Please verify with your provider's documentation if this is unclear.
Your certificate and the intermediate/authority certificate must be combined into one file for nginx. Here is an example of how to combine them together:
Update the permissions on these files. Modify the following filenames as necessary:
Use the following commands to deploy the example SSL configuration file provided on the server:NOTE: Below, some values are too long for a single line. Single lines that overflow to additional lines are marked with a
\. The backslash should not be included if the line is used as input.
Edit the following file:
Please modify the following key directives at least:
FQDN of the host, which must match the SSL certificate's Common Name
Path to the file of the certificate bundle that you created on the server. This value may not require modification.
Path to the .key file on the server.
Save the file.
To apply the new configuration, start or restart the nginx service:
Modify listening port for Designer Cloud powered by Trifacta platform
If you have changed the listening port as part of the above configuration change, then the
proxy.port setting in Designer Cloud powered by Trifacta platform
configuration must be updated. See Change Listening Port.
Add secure HTTP headers
If you have enabled SSL on the platform, you can optionally insert the following additional headers to all requests to the Trifacta node:
|X-XSS-Protection||HTTP and HTTPS|| |
|X-Frame-Options||HTTP and HTTPS|| |
NOTE: SSL must be enabled to apply these security headers.
To add these headers to all requests, please apply the following change:
- You can apply this change through the Admin Settings Page (recommended) or
trifacta-conf.json. For more information, see Platform Configuration Methods.
Locate the following setting and change its value to
- Save your changes and restart the platform.
Enable secure cookies
If you have enabled SSL on the platform, you can optionally enable the use of secure cookies.
NOTE: SSL must be enabled.
Disable default port
If you wish to access through the default port (
3005), you must do so external to the platform and through the node itself.
NOTE: The Designer Cloud powered by Trifacta platform requires access to the default port internally. You cannot disable external access to this port through the platform. You must disable through the operating system.
For more information, please see the documentation provided with your operating system distribution.
To replace a certificate with an updated one, please do the following.
- Copy in the new certificate to the Trifacta node.
Edit the nginx configuration file:
- In the configuration file, replace the values for the following settings to point to the new certificate:
- For more information, see "Configure nginx" above.
- Save the file, and restart the platform.
Problem - SELinux blocks proxy service from communicating with internal app service
If the Designer Cloud powered by Trifacta platform is installed on SELinux, the operating system blocks communications between the service that manages the proxy between users and the application and the service that manages internal application communications.
To determine if this problem is present, execute the following command:
The problem is present if an error similar to the following is returned:
For more information on this issue, see https://www.nginx.com/blog/using-nginx-plus-with-selinux.
The solution is to enable the following network connection through the operating system:
Restart the platform.
This page has no comments.