Configure Secure Internal Communication

CSA global search services use HTTPS to communicate internally with CSA on TCP ports that are not normally used for communication with other systems, the Cloud Service Management Console, or the Marketplace Portal. To prevent access to these ports from an internal or external network, it is recommended that you configure network firewall rules for these ports. Consult your network administrator about configuring firewall rules.

TCP Ports Used for Internal Communication

CSA Service	TCP Port Used	Communication between Nodes in a Clustered Environment?
Search Service	9000	No
Elasticsearch	9201	No
Elasticsearch	9300	Yes

Authentication Checking

Authentication checking has been turned on in order to improve security of the HPE Search Service. A certificate has been generated to make authorization checking possible.

Steps to generate a new certificate valid for another 120 days is given below:

• The keytool commands below will prompt for a password. The default password is 'changeit'.
• The following commands will fail unless you use the same Java executable that is used to run CSA.

1. On the server open a shell and change directory to %CSA_HOME%\elasticsearch-1.6.1\config.
2. Make a backup of the CSAKS.jks and CSATS.jks files.

3. To see the current ES certificate:

   keytool -list -v -keystore CSAKS.jks -alias ES

   Take note of the line that begins with "Owner" specifically the value after "CN=". This should be the FQDN (fully qualified domain name) of the server.

4. Delete the existing expired certificate:

   keytool -delete -alias ES -keystore CSAKS.jks

5. Generate a new certificate:

   keytool -genkey -alias ES -keyalg RSA -dname "CN=, OU=HP, O=HP, L=Palo Alto, ST=CA, C=US" -validity 120 -keystore CSAKS.jks

   Note: CN= should contain the FQDN (fully qualified domain name) of the server.

6. Import certificate to CSATS.jks file:

   keytool -export -alias ES -keystore CSAKS.jks -file es.crt

   keytool -delete -alias ES -keystore CSATS.jks

   keytool -importcert -trustcacerts -alias ES -file es.crt -keystore CSATS.jks

   Enter 'yes' to trust this certificate.

7. Import certificate in search service:

   For Windows:

   keytool -delete -alias ES -keystore ..\..\csa-search-service\.keystore -storetype PKCS12

   keytool -importcert -alias ES -file es.crt -keystore ..\..\csa-search-service\.keystore -storetype PKCS12 -trustcacerts

   For Linux:

   keytool -delete -alias ES -keystore ../../csa-search-service/.keystore -storetype PKCS12

   keytool -importcert -alias ES -file es.crt -keystore ../../csa-search-service/.keystore -storetype PKCS12 -trustcacerts

   Enter 'yes' to trust certificate.

8. Restart Elasticsearch service and HPE Search service.