Trusted Certificates¶
Which certificates each MetaMiner component must trust in a Power BI installation, and where each trust decision is made.
How it works¶
Every TLS connection checks that the other side presents a certificate that chains to a trusted CA and matches the host name. MetaMiner components use different trust stores depending on the connection.
| Connection | Who checks | Trust store used | What you do |
|---|---|---|---|
| MetaMiner Server (MMS) to Microsoft Entra ID, Power BI, Fabric and Graph | MMS | Java trust store of the Java runtime bundled with MetaMiner (public CAs) | Nothing. Microsoft certificates chain to public CAs |
| MetaMiner Administrator (MMA) validation of an environment | MMA | Same as above | Nothing |
| MetaMiner Client (MMC) to the MMS | MMC | Java trust store of the client, or the one you set in MetaMiner.ini |
Add your issuing CA. See Client to Server SSL |
| MMC to Microsoft sign-in, Fabric and OneLake | MMC | Same trust store as the line above | Nothing, if your client trust store starts from the bundled one |
| Browser to the MMS web apps | Browser | Windows certificate store of the workstation | Distribute your CA with Group Policy or Intune |
| MMS to the MetaMiner Database | MMS (PostgreSQL driver) | root.crt in the service account's profile |
See MetaMiner Database SSL |
| MMS to LDAP or Active Directory | MMS | Java trust store of the MMS | See Import Users from LDAP or AD |
Connections from the MMS to Microsoft use TLS 1.2 or TLS 1.3 only.
Networks that inspect TLS¶
Some networks route outbound HTTPS through a proxy that decrypts and re-signs traffic with a company CA. The bundled Java trust store does not contain that CA, so the MMS cannot verify Microsoft's endpoints through such a proxy.
Prefer an exemption: ask your network team to exclude the Microsoft endpoints MetaMiner uses from TLS inspection for the MetaMiner Server host. See Network and Microsoft Endpoints.
TODO: supported procedure when TLS inspection cannot be exempted
Product team to confirm how customers add a TLS-inspection CA for the MetaMiner Server's Microsoft connections, and whether outbound HTTP proxies are supported. Source to check: the Power BI HTTP client on the server uses the Java default trust store.
Review¶
- Keep the Java runtime current by installing MetaMiner updates; updates refresh the bundled public CAs. See Installing New Releases.
- Track the expiry of the certificates you issued for the MMS and the database in your certificate inventory. MetaMiner does not warn before they expire.
- Include client trust store files in your workstation build process, so new workstations trust your CA from the start.
Image of diagram: MetaMiner Server, Client, browser and database with the trust store used on each connection
../images/security/trust-stores-diagram.png