CxSAST supports secure communication between CxManager and CxEngine based on SSL certificates. These instructions take Windows and Linux support for CxEngine into consideration.
The Cx Engine is working on a WCF service that is not managed via the IIS console. The steps below explain how to configure the secure connection on both the CxManager and the CxEngine servers.
The secure connection is established between two servers only, it can be configured with Self Signed Certificates or real CA`s certificates.
This section explains how to establish a secure connection when running CxEngine under Windows.
It is recommended to use the PowerShell command New-SelfSignedCertificate as explained for self-signed certificates.
The certificate must have the following key usages: DigitalSignature, KeyEncipherment The command’s syntax differs between PowerShell versions.
Create a certificate (Certificate Authority-CA or self-signed).
Place the certificate in the store under Local Machine\Personal\Certificates.
Make the private key available to the service. To do so, go to Local Machine\Personal\Certificates and then to Manage Private Keys on the certificate.
Add “Network Service” to the list of authorized users. Read permissions are sufficient.
Copythe certificate to Local Machine\Trusted Root Certification Authority\Certificates.
Set these environment variables on the host (machine) level as explained below.
To set the environment variables:
Before setting the environment variables, you have to know the Certificate-Subject.
To obtain the pfx certificate subject name, open the PowerShell and run Get-PfxCertificate –FilePath<full path of the PFX file>, for example Get-PfxCertificate -FilePath "C:\Users\Administrator\Desktop\myCert.pfx".
Enter your certificate’s password when prompted. The Certificate-Subject appears as illustrated below.
Set the following environment variables as follows which includes entering the certificate subject that you just obtained: SETX CX_ENGINE_TLS_ENABLE true /m SETX CX_ENGINE_CERTIFICATE_SUBJECT_NAME Certificate-Subject /m, for example SETX CX_ENGINE_CERTIFICATE_SUBJECT_NAME CN=cx_example.com /m
Restart the CxEngineService.
Place the certificate in the Local Machine\Trusted Root CA store.
public only .cer/.crt is sufficient.
Use a pfx (pkcs12) certificate.
The CxEngine server package consists of the components listed below. Additional information is available in the installation instructions for Linux.
cx-engine-server.tar (CxEngine image)
To establish a secure connection:
1. Copy the certificate to the location of your certificates, for example, /usr/my/certificates
2. Update the following environment variables in the server.env file: