Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Operations Manager i10.62

Administer > Hardening > Use TLS in OMi

Use TLS in OMi

Transport Layer Security (TLS) technology secures communication by encrypting data and providing authentication. Without TLS encryption, packets of information travel over networks in full view.

Every TLS certificate is created for a particular server in a specific domain by a Certificate Authority (CA). When an application user or data collector accesses an OMi server, TLS authenticates the server, and can also be configured to authenticate the client. Additionally, OMi establishes an encryption method and a unique key for the communication session.

OMi fully supports the TLS protocol version 1.0 or later. The TLS channel is configured on the OMi servers/clients as required.

For detailed information about how to set up TLS for database connections, see the OMi Database Guide.

Learn more

TLS Termination

Secure communication via HTTPS can terminate either at the load balancer/ reverse proxy or on the OMi gateway server.

If it terminates on the OMi gateway server, the web server on the gateway server is configured to support/require TLS. Otherwise, if TLS terminates on the load balancer/reverse proxy, then only the load balancer/reverse proxy needs to be configured for secure communication.

If there is a load balancer/reverse proxy in front of a OMi gateway server, it is recommended to have TLS terminate on the load balancer/reverse proxy. For BBC channels, see the BBC recommendations and configuration instructions in Configure BBC port 383 connection on reverse proxy.

The following table addresses TLS termination in the High Availability environment:

TLS Termination On	TLS on Load Balancer	TLS on Gateway	Advantages/ Disadvantages
Load Balancer/Reverse Proxy	Yes	No	This is a recommended configuration. It allows: Maintenance of certificates in one place (on load balancer/reverse proxy) Reduced processing of load on OMi gateway servers On each load balancer/reverse proxy, use server certificates issued to the name of the external access point (FQDN) that users/data collectors are using to access OMi. If multiple load balancers/reverse proxies share the load, each one must have these certificates imported.
Load Balancer/Reverse Proxy and Gateway (TLS all the way)	Yes	Yes	This is a less ideal configuration, especially where load balancers are concerned. It requires: Maintenance of certificates in multiple places (load balancer/reverse proxy and gateway servers) Expensive TLS renegotiation in load balanced environment for data collectors (see note below) In this configuration, in addition to installing certificates on the load balancer, also install server certificates on the gateway server, using a server certificate issued to the FQDN name of the gateway server. In a high availability environment with multiple gateway servers: Traffic from the same data collector will be load-balanced between different gateway servers using a round-robin mechanism. If you have a different certificate on each gateway server issued to a different name, in the worst case scenario, switching between gateway servers will require a TLS renegotiation process to run each time there is a switch between gateways server. This is very expensive in terms of CPU use and network traffic, on both the server and client sides. For this reason, TLS termination is typically done on the load balancer.
Gateway	No	Yes	A secure channel for connections to the OMi server (via load balancer or direct) is mandatory in many OMi environments. OMi enables you to generate and install web servers' certificates using the configuration wizard, thereby reducing the TLS configuration and maintenance efforts to a minimum. Once the web servers are configured for TLS, you can configure the load balancer to forward requests to the gateway servers and have TLS termination on the gateways. This means: Less configuration effort on the load balancer. Sticky sessions may work less reliably as stickiness can only be determined on the IP level, which may result in a less optimal load balancing.

TLS Termination On

TLS on Load Balancer

TLS on Gateway

Advantages/ Disadvantages

Load Balancer/Reverse Proxy

Yes

This is a recommended configuration. It allows:

Maintenance of certificates in one place (on load balancer/reverse proxy)
Reduced processing of load on OMi gateway servers

On each load balancer/reverse proxy, use server certificates issued to the name of the external access point (FQDN) that users/data collectors are using to access OMi.

If multiple load balancers/reverse proxies share the load, each one must have these certificates imported.

Load Balancer/Reverse Proxy and Gateway (TLS all the way)

Yes

This is a less ideal configuration, especially where load balancers are concerned. It requires:

Maintenance of certificates in multiple places (load balancer/reverse proxy and gateway servers)
Expensive TLS renegotiation in load balanced environment for data collectors (see note below)

In this configuration, in addition to installing certificates on the load balancer, also install server certificates on the gateway server, using a server certificate issued to the FQDN name of the gateway server.

In a high availability environment with multiple gateway servers:

Traffic from the same data collector will be load-balanced between different gateway servers using a round-robin mechanism. If you have a different certificate on each gateway server issued to a different name, in the worst case scenario, switching between gateway servers will require a TLS renegotiation process to run each time there is a switch between gateways server. This is very expensive in terms of CPU use and network traffic, on both the server and client sides. For this reason, TLS termination is typically done on the load balancer.

Gateway

Yes

A secure channel for connections to the OMi server (via load balancer or direct) is mandatory in many OMi environments. OMi enables you to generate and install web servers' certificates using the configuration wizard, thereby reducing the TLS configuration and maintenance efforts to a minimum. Once the web servers are configured for TLS, you can configure the load balancer to forward requests to the gateway servers and have TLS termination on the gateways. This means:

Less configuration effort on the load balancer.
Sticky sessions may work less reliably as stickiness can only be determined on the IP level, which may result in a less optimal load balancing.

Send Help Center feedback