Skip to content

Get A Certificate

Before you start

Goal

  • Get a certificate to enable Altair SLC Hub to use HTTPS for external communication.

Altair SLC Hub requires HTTPS for external communication. Without HTTPS, authentication redirect URLs will not match the scheme the browser sees, causing the login flow to fail.

In previous versions, HTTP was the default for local deployments. Altair SLC Hub now enables HTTPS automatically during bootstrap. HTTP is only available when you explicitly run hubctl bootstrap --nohttps.

On Windows, if hubctl bootstrap --nohttps fails during Keycloak initialization with HTTPS required, see Troubleshooting: hubctl bootstrap --nohttps fails with HTTPS required during Keycloak initialization on Windows.

Note

All traffic in the Altair SLC Hub cluster between the Altair SLC Hub server host and any worker node hosts is secured by default. This section relates to securing the external traffic between a client browsers and the Altair SLC Hub, or when making REST API calls to the Altair SLC Hub.

Note

The Altair SLC Hub can only be configured to use HTTP or HTTPS, it is not possible to configure Altair SLC Hub to serve both HTTP and HTTPS. Once configured for HTTPS, requests made to HTTP will automatically redirect to HTTPS.

Generate a certificate

To enable HTTPS, a certificate and private key are required. Some providers will give you a certificate and key suitable for serving HTTPS for a Fully Qualified Domain Name you own. You can see the address the Altair SLC Hub is serving by running the following command: 

hubctl config print ingress.hostname

It may be preferable to generate a certificate signing request and private key locally, and then send the certificate signing request to the Certificating Authority.

Note

The hostname referenced in the certificate must be the same as the hostname in the ingress.url configuration setting. Use hubctl config print ingress.url to view the configuration setting.

Note

The private key must not have a password. There is no option in the Altair SLC Hub configuration to specify a password to use when reading the private key file.

Generating a Certificate Signing Request

To help get a certificate for the Altair SLC Hub you can generate a certificate signing request using the command

   hubctl generate externalcsr

This command will generate certificate signing request and private key files ([var directory]/ca/public/external/external.csr.pem and [var directory]/ca/public/external/external.key.pem respectively).

Generating external certificates for testing

For testing HTTPS access to Altair SLC Hub, you can generate an external Certificate Authority (CA) and a server certificate signed by that CA.

You can generate these certificates using the following command:

    hubctl generate externalcert

This command will generate the following files:

  • CA certificate: [var directory]/ca/public/external/external.ca.cert.pem
  • CA private key: [var directory]/ca/public/external/external.ca.key.pem
  • Server certificate: [var directory]/ca/public/external/external.cert.pem
  • Server private key: [var directory]/ca/public/external/external.key.pem

To trust the generated server certificate, clients must trust the generated CA certificate (external.ca.cert.pem).