There are two separate Nginx services on the server: one service for internal application use, and one service that functions as a proxy between users and the

Steps:

1. Log into the 

   D s item
   item server

   as the centos user. Switch to the root user:

   Code Block
   sudo su

   
   

2. Enable the proxy nginx service so that it starts on boot:

   Code Block
   systemctl enable nginx

   
   

3. Create a folder for the private key and limit access to it:

   Code Block
   sudo mkdir /etc/ssl/private/ && sudo chmod 700 /etc/ssl/private

   
   

4. Copy the following files to the server. If you copy and paste the content, please ensure that you do not miss characters or insert unwanted characters.

   1. The .key file should go into the /etc/ssl/private/ directory.

   2. The .crt file and the CA bundle/intermediate certificate bundle should go into the /etc/ssl/certs/ directory.

      Info
      NOTE: The delivery name and format of these files varies by provider. Please verify with your provider's documentation if this is unclear.

      
      

   3. Your certificate and the intermediate/authority certificate must be combined into one file for nginx. Here is an example of how to combine them together:

      Code Block
      cat example_com.crt bundle.crt >> ssl-bundle.crt

      
      

5. Update the permissions on these files. Modify the following filenames as necessary:

   Code Block
   sudo chmod 600 /etc/ssl/certs/ssl-bundle.crt sudo chmod 600 /etc/ssl/private/your-private-cert.key

   
   

6. Use the following commands to deploy the example SSL configuration file provided on the server:
   

   D s property overflow

   Code Block
   cp /opt/trifacta/conf/ssl-nginx.conf.sample /etc/nginx/conf.d/trifacta.conf && \ rm /etc/nginx/conf.d/default.conf

   
   

7. Edit the following file:

   Code Block
   /etc/nginx/conf.d/trifacta.conf

   
   

8. Please make the following modifications:

   Directive	Description
   server_name	FQDN of the host, which must match the SSL certificate's Common Name
   ssl_certificate	Path to the file of the certificate bundle that you created on the server. This value may not require modification.
   ssl_certificate_key	Path to the .key file on the server.

   
   Example file:

   Code Block

   server { listen 443; ssl on; server_name EXAMPLE.CUSTOMER.COM; # Don't limit the size of client uploads. client_max_body_size 0; access_log /var/log/nginx/ssl-access.log; error_log /var/log/nginx/ssl-error.log; ssl_certificate /etc/ssl/certs/ssl-bundle.crt; ssl_certificate_key /etc/ssl/certs/EXAMPLE-NAME.key; ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers RC4:HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; keepalive_timeout 60; ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; location / { proxy_pass http://localhost:3005; proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504; proxy_set_header Accept-Encoding ""; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; add_header Front-End-Https on; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_redirect off; } proxy_connect_timeout 6000; proxy_send_timeout 6000; proxy_read_timeout 6000; send_timeout 6000; } server { listen 80; return 301 https://$host$request_uri; }

   
   

9. Save the file.

10. To apply the new configuration, start or restart the nginx service:

    Code Block
    service nginx restart

    
    

Modify listening port for

D s platform

If you have changed the listening port as part of the above configuration change, then the proxy.port setting in

Add secure HTTP headers

If you have enabled SSL on the platform, you can optionally insert the following additional headers to all requests to the

Steps:

To add these headers to all requests, please apply the following change:

1. D s config

2. Locate the following setting and change its value to true:

   Code Block
   "proxy.securityHeaders.httpsHeaders": false,

   
   

3. Save your changes and restart the platform.

Enable secure cookies

If you have enabled SSL on the platform, you can optionally enable the use of secure cookies.

Steps:

1. D s config

2. Locate the following setting and change its value to true:

   Code Block
   "webapp.session.cookieSecureFlag": false,

   
   

3. Save your changes and restart the platform.