View source for GWS/Current/GWSPEGuide/ConfigureTLS

{{Article
|Standalone=No
|DisplayName=Configure connections with TLS and authentication
|Context=Learn how to configure Transport Layer Security and Authentication for connections to third-party services and non-containerized Genesys servers.
|ComingSoon=No
|Section={{Section
|alignment=Vertical
|structuredtext=Web Services and Applications (GWS) supports secure connections to third-party services and legacy Genesys servers using Transport Layer Security (TLS). 

To enable TLS, you must download and unpack the '''gws-services''' Helm chart locally. Next, create any required certificates for the services and put the truststores under the '''gws-services''' directory of the unpacked chart. For example: '''gws-services/crts/gwsPlatformSettingPostgresTrustore.p12.''' Following this example, the setting for the PostgreSQL truststore would be: <code>secretsTls.postgres.truststores.gws-plaftom-setting-postgres-truststore: crts/gwsPlatformSettingPostgresTrustore.p12</code>{{NoteFormat|When you {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=Deploy}}, make sure to point to your local files during the installation.|}}Next, configure TLS by overriding Helm chart values in the '''values.yaml''' file. See {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=ConfigureTLS|anchor=thirdpartyservices|display text=TLS for third-party services}} and {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=ConfigureTLS|anchor=genesysservers|display text=TLS for legacy Genesys servers}} for details.
|Status=No
}}{{Section
|sectionHeading=TLS for third-party services
|anchor=thirdpartyservices
|alignment=Vertical
|structuredtext=GWS support TLS connections to the third-party services Redis, PostgreSQL, and Elasticsearch. To enable TLS for these services, set the following parameters in the '''values.yaml''' file:  

*{{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=Configure|anchor=gwsServices.gwsAppProvisioning.postgres.enableTls|display text=gwsServices.gwsAppProvisioning.postgres.enableTls}}
*{{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=Configure|anchor=postgres.enableTls  |display text=postgres.enableTls  }}
*{{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=Configure|anchor=elasticSearch.enableTls|display text=elasticSearch.enableTls}}
*{{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=Configure|anchor= redis.enableTls |display text= redis.enableTls }}

You must also define the truststore paths and passwords in the tables below:{{AnchorDiv|redis}}
===Redis===
{{{!}} class="wikitable" style="table-layout: fixed; overflow-wrap: break-word;" {{!}}
!Parameter
!Description
!Valid values
!Default
{{!}}-
{{!}}secretsTls.redis.enabled
{{!}}Specifies whether a Kubernetes secret is created for the TLS connection to the Redis cluster.
{{!}}true or false
{{!}}false
{{!}}-
{{!}}secretsTls.redis.truststores.gws-platform-datacollector-redis-truststore
{{!}}The Redis client truststore path for the GWS Data Collector Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}secretsTls.redis.truststores.gws-platform-ixn-redis-truststore
{{!}}The Redis client truststore path for the GWS Interaction Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}secretsTls.redis.truststores.gws-app-workspace-redis-truststore
{{!}}The Redis client truststore path for the GWS Workspace Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}secretsTls.redis.truststores.gws-app-provisioning-redis-truststore
{{!}}The Redis client truststore path for Agent Setup.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}secretsTls.redis.truststores.gws-platform-voice-redis-truststore
{{!}}The Redis client truststore path for the GWS Voice Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}secretsTls.redis.passwords.gws-platform-datacollector-redis-truststore-password
{{!}}The Redis client truststore password for the GWS Data Collector Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}secretsTls.redis.passwords.gws-platform-ixn-redis-truststore-password
{{!}}The Redis client truststore password for the GWS Interaction Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}secretsTls.redis.passwords.gws-app-workspace-redis-truststore-password
{{!}}The Redis client truststore password for the GWS Workspace Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}secretsTls.redis.passwords.gws-app-provisioning-redis-truststore-password
{{!}}The Redis client truststore password for Agent Setup.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}secretsTls.redis.passwords.gws-platform-voice-redis-truststore-password
{{!}}The Redis client truststore password for the GWS Voice Service.
{{!}}A valid password
{{!}}""
{{!}}}
{{AnchorDiv|postgres}}
===PostgreSQL===
{{{!}} class="wikitable" style="table-layout: fixed; overflow-wrap: break-word;" {{!}}
!Parameter
!Description
!Valid values
!Default
{{!}}-
{{!}}secretsTls.postgres.enabled
{{!}}Specifies whether a Kubernetes secret is created for the TLS connection to PostgreSQL.
{{!}}true or false
{{!}}false
{{!}}-
{{!}}secretsTls.postgres.truststores.gws-platform-setting-postgres-truststore
{{!}}The PostgreSQL client truststore path for the GWS Setting Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}secretsTls.postgres.passwords.gws-platform-setting-postgres-truststore-password
{{!}}The PostgreSQL client truststore password for the GWS Setting Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}secretsTls.postgresprovisioning.enabled
{{!}}Specifies whether a Kubernetes secret is created for the gws-app-provisioning TLS connection to PostgreSQL.
{{!}}true or false
{{!}}false
{{!}}-
{{!}}secretsTls.postgresprovisioning.truststores.gws-app-provisioning-postgres-truststore
{{!}}The PostgreSQL client truststore path for gws-app-provisioning.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}secretsTls.postgresprovisioning.passwords.gws-app-provisioning-postgres-truststore-password
{{!}}The PostgreSQL client truststore password for gws-app-provisioning.
{{!}}A valid password
{{!}}""
{{!}}}
{{AnchorDiv|elasticsearch}}
===Elasticsearch===
{{{!}} class="wikitable" style="table-layout: fixed; overflow-wrap: break-word;" {{!}}
!Parameter
!Description
!Valid values
!Default
{{!}}-
{{!}}secretsTls.elasticsearch.enabled
{{!}}Specifies whether a Kubernetes secret is created for the TLS connection to the Elasticsearch cluster.
{{!}}true or false
{{!}}false
{{!}}-
{{!}}secretsTls.elasticsearch.truststores.gws-platform-datacollector-elasticsearch-truststore
{{!}}The Elasticsearch client truststore path for the GWS Data Collector Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}secretsTls.elasticsearch.passwords.gws-platform-datacollector-elasticsearch-truststore-password
{{!}}The Elasticsearch client truststore password for the GWS Data Collector Service.
{{!}}A valid password
{{!}}""
{{!}}}
|Status=No
}}{{Section
|sectionHeading=TLS for legacy Genesys servers
|anchor=genesysservers
|alignment=Vertical
|structuredtext=GWS support TLS connections to legacy Genesys servers in a mixed mode environment. GWS uses the [https://docs.genesys.com/Documentation/PSDK Platform SDK] to connect to legacy Genesys servers, such as [https://docs.genesys.com/Documentation/FR Configuration Server], [https://docs.genesys.com/Documentation/IXN Interaction Server], [https://docs.genesys.com/Documentation/TS T-Server], [https://docs.genesys.com/Documentation/UCS Universal Contact Server], [https://docs.genesys.com/Documentation/RTME Stat Server], [https://docs.genesys.com/Documentation/ES Chat Server], and [https://docs.genesys.com/Documentation/OU Outbound Contact Server].

GWS services use [https://docs.genesys.com/Documentation/PSDK/9.0.x/Developer/TLSQuickStart upgrade mode ports] for TLS connections between Platform SDK and legacy Genesys services, which means you cannot enable TLS in the GWS '''values.yaml''' file. Instead, [https://docs.genesys.com/Documentation/PSDK/9.0.x/Developer/TLSTLSParametersinConfigManager configure the TLS parameters] in Configuration Server.

You must also define the truststore paths and passwords in the tables below:
{{AnchorDiv|truststore}}
===Truststore paths===
{{{!}} class="wikitable" style="table-layout: fixed; overflow-wrap: break-word;" {{!}}
!Parameter
!Description
!Valid values
!Default
{{!}}-
{{!}}psdk.enabled
{{!}}Specifies whether a Kubernetes secret is created for TLS connections to legacy Genesys servers.
{{!}}true or false
{{!}}false
{{!}}-
{{!}}psdk.truststores.gws-platform-configuration-psdk-truststore
{{!}}The PSDK client truststore path for the GWS Configuration Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}psdk.truststores.gws-platform-ixn-psdk-truststore
{{!}}The PSDK client truststore path for the GWS Interaction Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}psdk.truststores.gws-platform-chat-psdk-truststore
{{!}}The PSDK client truststore path for the Chat Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}psdk.truststores.gws-platform-ucs-psdk-truststore
{{!}}The PSDK client truststore path for the UCS Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}psdk.truststores.gws-platform-voice-psdk-truststore
{{!}}The PSDK client truststore path for the GWS Voice Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}psdk.truststores.gws-platform-statistics-psdk-truststore
{{!}}The PSDK client truststore path for the GWS Statistics Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}psdk.truststores.truststores.gws-platform-datacollector-psdk-truststore
{{!}}The PSDK client truststore path for the GWS Data Collector Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}psdk.gws-platform-ocs-psdk-truststore
{{!}}The PSDK client truststore path for the GWS OCS Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}}
{{AnchorDiv|passwords}}
===Truststore passwords===
{{{!}} class="wikitable" style="table-layout: fixed; overflow-wrap: break-word;" {{!}}
!Parameter
!Description
!Valid values
!Default
{{!}}-
{{!}}psdk.passwords.gws-platform-configuration-psdk-truststore-password
{{!}}The PSDK client truststore password for the GWS Configuration Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}psdk.passwords.gws-platform-ixn-psdk-truststore-password
{{!}}The PSDK client truststore password for the GWS Interaction Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}psdk.passwords.gws-platform-chat-psdk-truststore-password
{{!}}The PSDK client truststore password for the Chat Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}psdk.passwords.gws-platform-ucs-psdk-truststore-password
{{!}}The PSDK client truststore password for the UCS Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}psdk.passwords.gws-platform-voice-psdk-truststore-password
{{!}}The PSDK client truststore password for the GWS Voice Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}psdk.passwords.gws-platform-statistics-psdk-truststore-password
{{!}}The PSDK client truststore password for the GWS Statistics Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}psdk.passwords.gws-platform-datacollector-psdk-truststore-password
{{!}}The PSDK client truststore password for the GWS Data Collector Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}psdk.passwords.gws-platform-ocs-psdk-truststore-password
{{!}}The PSDK client truststore password for the GWS OCS Service.
{{!}}A valid password
{{!}}""
{{!}}}
|Status=No
}}
}}