SSL Overview¶
A map of every network connection MetaMiner makes, whether it can use TLS, and the page that configures it.
How it works¶
Each connection is encrypted separately. Turning on SSL for the MetaMiner Server (MMS) port covers every client and browser connection, because the MetaMiner Client (MMC), the web console and Meta Query on the web all use that one port. Connections from the MMS to the MetaMiner Database (MMDB) and to BusinessObjects each have their own setting.
flowchart LR
MMC[MetaMiner Client] -->|1 TLS| MMS[MetaMiner Server]
BR[Browser] -->|2 TLS| MMS
MMS -->|3 local only| WA[Web Apps service]
MMS -->|4 SSL| MMDB[(MetaMiner Database)]
RT[Reporting tools] -->|5 SSL| MMDB
MMS -->|6 CORBA SSL| CMS[BO CMS and servers]
MMS -->|7 HTTPS| WACS[BO RESTful web service]
MMS -->|8 driver SSL| ADB[(Audit and CMS databases)]
MMS -->|9 LDAPS| DIR[LDAP or AD]
MMS -->|10 SSL| SMTP[Mail server]Connection map¶
| # | Connection | Default port | Encryption | Configure on |
|---|---|---|---|---|
| 1 | MMC to MMS | 49714 | TLS 1.2 or 1.3 when MMS SSL is on | MetaMiner Server SSL, then Client to Server SSL |
| 2 | Browser to MMS (/web/...) |
49714 | Same certificate as #1 | MetaMiner Server SSL |
| 3 | MMS to Web Apps service | 49717 | Does not leave the server host | Nothing to configure. Keep the port closed in the firewall (Network Exposure) |
| 4 | MMS to MMDB | 49614 embedded, 5432 typical external | PostgreSQL SSL | MetaMiner Database SSL |
| 5 | ODBC or JDBC clients to MMDB | as #4 | PostgreSQL SSL | Database External Connections |
| 6 | MMS to BusinessObjects CMS and servers (BO SDK) | 6400 CMS name server, plus BO request ports | CORBA SSL | Server to BusinessObjects SSL |
| 7 | MMS and MMA to the BO RESTful web service (WACS) and BI launch pad | 6405 RESTful, your web tier port | HTTPS | Trusted Certificates |
| 8 | MMS to BusinessObjects audit and CMS databases | Database default | JDBC driver SSL options in the database settings | Audit and CMS Databases |
| 9 | MMS and MMA to LDAP or Active Directory | 389 or 636 | LDAPS | Import Users from LDAP or AD |
| 10 | MMS to the mail server | Your SMTP port | SSL option in e-mail settings |
The MMC also opens documents in your browser through the BI launch pad URL of the environment. Enter that URL with https:// when your web tier uses TLS.
Recommended order¶
- Turn on MetaMiner Server SSL and distribute your CA to clients with Client to Server SSL.
- Use HTTPS for the BusinessObjects RESTful web service and trust its CA (Trusted Certificates).
- Turn on MetaMiner Database SSL when the database is remote or read over the network.
- Add CORBA SSL, LDAPS and SMTP SSL where your policies require them.
Certificates you need¶
| For | Certificate | Key format |
|---|---|---|
| MMS (#1, #2) | Server certificate for the MMS host names, from your CA | RSA private key, PEM, PKCS#8 |
| MMDB (#4, #5) | Server certificate for the database host name | PEM certificate and key, as PostgreSQL requires |
| Clients of #1 | Your issuing CA certificate in the MMC trust store | - |
| MMS and MMA for #7 and #9 | The CA of the BusinessObjects web tier and of the directory, trusted on the MMS host | - |
| CORBA SSL (#6) | The certificate set created with the BusinessObjects sslconfig tool |
As SAP documents |