GWS/Current/GWSPEGuide/ConfigureTLS - Revision history

WikiSysop at 19:45, July 14, 2022

2022-07-14T19:45:46Z

Jumunn: Published

2022-05-04T18:36:07Z

Published

WikiSysop: Created page with "{{Article |Standalone=No |DisplayName=Configure connections with TLS and authentication |Context=Learn how to configure Transport Layer Security and Authentication for connect..."

2022-04-08T18:45:53Z

Created page with "{{Article |Standalone=No |DisplayName=Configure connections with TLS and authentication |Context=Learn how to configure Transport Layer Security and Authentication for connect..."

New page

{{Article
|Standalone=No
|DisplayName=Configure connections with TLS and authentication
|Context=Learn how to configure Transport Layer Security and Authentication for connections to third-party services and non-containerized Genesys servers.
|ComingSoon=No
|Section={{Section
|alignment=Vertical
|structuredtext=Web Services and Applications (GWS) supports secure connections to third-party services and legacy Genesys servers using Transport Layer Security (TLS).

To enable TLS, you must download and unpack the '''gws-services''' Helm chart locally. Next, create any required certificates for the services and put the truststores under the '''gws-services''' directory of the unpacked chart. For example: '''gws-services/crts/gwsPlatformSettingPostgresTrustore.p12.''' Following this example, the setting for the PostgreSQL truststore would be: <code>secretsTls.postgres.truststores.gws-plaftom-setting-postgres-truststore: crts/gwsPlatformSettingPostgresTrustore.p12</code>{{NoteFormat|When you {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=Deploy}}, make sure to point to your local files during the installation.|}}Next, configure TLS by overriding Helm chart values in the '''values.yaml''' file. See {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=ConfigureTLS|anchor=thirdpartyservices|display text=TLS for third-party services}} and {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=ConfigureTLS|anchor=genesysservers|display text=TLS for legacy Genesys servers}} for details.
|Status=No
}}{{Section
|sectionHeading=TLS for third-party services
|anchor=thirdpartyservices
|alignment=Vertical
|structuredtext=GWS support TLS connections to the third-party services Redis, PostgreSQL, and Elasticsearch. To enable TLS for these services, set the following parameters in the '''values.yaml''' file:

*{{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=Configure|anchor=gwsServices.gwsAppProvisioning.postgres.enableTls|display text=gwsServices.gwsAppProvisioning.postgres.enableTls}}
*{{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=Configure|anchor=postgres.enableTls |display text=postgres.enableTls }}
*{{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=Configure|anchor=elasticSearch.enableTls|display text=elasticSearch.enableTls}}
*{{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=Configure|anchor= redis.enableTls |display text= redis.enableTls }}

You must also define the truststore paths and passwords in the tables below:{{AnchorDiv|redis}}
===Redis===
{{{!}} class="wikitable" style="table-layout: fixed; overflow-wrap: break-word;" {{!}}
!Parameter
!Description
!Valid values
!Default
{{!}}-
{{!}}secretsTls.redis.enabled
{{!}}Specifies whether a Kubernetes secret is created for the TLS connection to the Redis cluster.
{{!}}true or false
{{!}}false
{{!}}-
{{!}}secretsTls.redis.truststores.gws-platform-datacollector-redis-truststore
{{!}}The Redis client truststore path for the GWS Data Collector Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}secretsTls.redis.truststores.gws-platform-ixn-redis-truststore
{{!}}The Redis client truststore path for the GWS Interaction Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}secretsTls.redis.truststores.gws-app-workspace-redis-truststore
{{!}}The Redis client truststore path for the GWS Workspace Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}secretsTls.redis.truststores.gws-app-provisioning-redis-truststore
{{!}}The Redis client truststore path for Agent Setup.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}secretsTls.redis.truststores.gws-platform-voice-redis-truststore
{{!}}The Redis client truststore path for the GWS Voice Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}secretsTls.redis.passwords.gws-platform-datacollector-redis-truststore-password
{{!}}The Redis client truststore password for the GWS Data Collector Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}secretsTls.redis.passwords.gws-platform-ixn-redis-truststore-password
{{!}}The Redis client truststore password for the GWS Interaction Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}secretsTls.redis.passwords.gws-app-workspace-redis-truststore-password
{{!}}The Redis client truststore password for the GWS Workspace Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}secretsTls.redis.passwords.gws-app-provisioning-redis-truststore-password
{{!}}The Redis client truststore password for Agent Setup.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}secretsTls.redis.passwords.gws-platform-voice-redis-truststore-password
{{!}}The Redis client truststore password for the GWS Voice Service.
{{!}}A valid password
{{!}}""
{{!}}}
{{AnchorDiv|postgres}}
===PostgreSQL===
{{{!}} class="wikitable" style="table-layout: fixed; overflow-wrap: break-word;" {{!}}
!Parameter
!Description
!Valid values
!Default
{{!}}-
{{!}}secretsTls.postgres.enabled
{{!}}Specifies whether a Kubernetes secret is created for the TLS connection to PostgreSQL.
{{!}}true or false
{{!}}false
{{!}}-
{{!}}secretsTls.postgres.truststores.gws-platform-setting-postgres-truststore
{{!}}The PostgreSQL client truststore path for the GWS Setting Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}secretsTls.postgres.passwords.gws-platform-setting-postgres-truststore-password
{{!}}The PostgreSQL client truststore password for the GWS Setting Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}secretsTls.postgresprovisioning.enabled
{{!}}Specifies whether a Kubernetes secret is created for the gws-app-provisioning TLS connection to PostgreSQL.
{{!}}true or false
{{!}}false
{{!}}-
{{!}}secretsTls.postgresprovisioning.truststores.gws-app-provisioning-postgres-truststore
{{!}}The PostgreSQL client truststore path for gws-app-provisioning.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}secretsTls.postgresprovisioning.passwords.gws-app-provisioning-postgres-truststore-password
{{!}}The PostgreSQL client truststore password for gws-app-provisioning.
{{!}}A valid password
{{!}}""
{{!}}}
{{AnchorDiv|elasticsearch}}
===Elasticsearch===
{{{!}} class="wikitable" style="table-layout: fixed; overflow-wrap: break-word;" {{!}}
!Parameter
!Description
!Valid values
!Default
{{!}}-
{{!}}secretsTls.elasticsearch.enabled
{{!}}Specifies whether a Kubernetes secret is created for the TLS connection to the Elasticsearch cluster.
{{!}}true or false
{{!}}false
{{!}}-
{{!}}secretsTls.elasticsearch.truststores.gws-platform-datacollector-elasticsearch-truststore
{{!}}The Elasticsearch client truststore path for the GWS Data Collector Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}secretsTls.elasticsearch.passwords.gws-platform-datacollector-elasticsearch-truststore-password
{{!}}The Elasticsearch client truststore password for the GWS Data Collector Service.
{{!}}A valid password
{{!}}""
{{!}}}
|Status=No
}}{{Section
|sectionHeading=TLS for legacy Genesys servers
|anchor=genesysservers
|alignment=Vertical
|structuredtext=GWS support TLS connections to legacy Genesys servers in a mixed mode environment. GWS uses the [https://docs.genesys.com/Documentation/PSDK Platform SDK] to connect to legacy Genesys servers, such as [https://docs.genesys.com/Documentation/FR Configuration Server], [https://docs.genesys.com/Documentation/IXN Interaction Server], [https://docs.genesys.com/Documentation/TS T-Server], [https://docs.genesys.com/Documentation/UCS Universal Contact Server], [https://docs.genesys.com/Documentation/RTME Stat Server], [https://docs.genesys.com/Documentation/ES Chat Server], and [https://docs.genesys.com/Documentation/OU Outbound Contact Server].

GWS services use [https://docs.genesys.com/Documentation/PSDK/9.0.x/Developer/TLSQuickStart upgrade mode ports] for TLS connections between Platform SDK and legacy Genesys services, which means you cannot enable TLS in the GWS '''values.yaml''' file. Instead, [https://docs.genesys.com/Documentation/PSDK/9.0.x/Developer/TLSTLSParametersinConfigManager configure the TLS parameters] in Configuration Server.

You must also define the truststore paths and passwords in the tables below:
{{AnchorDiv|truststore}}
===Truststore paths===
{{{!}} class="wikitable" style="table-layout: fixed; overflow-wrap: break-word;" {{!}}
!Parameter
!Description
!Valid values
!Default
{{!}}-
{{!}}psdk.enabled
{{!}}Specifies whether a Kubernetes secret is created for TLS connections to legacy Genesys servers.
{{!}}true or false
{{!}}false
{{!}}-
{{!}}psdk.truststores.gws-platform-configuration-psdk-truststore
{{!}}The PSDK client truststore path for the GWS Configuration Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}psdk.truststores.gws-platform-ixn-psdk-truststore
{{!}}The PSDK client truststore path for the GWS Interaction Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}psdk.truststores.gws-platform-chat-psdk-truststore
{{!}}The PSDK client truststore path for the Chat Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}psdk.truststores.gws-platform-ucs-psdk-truststore
{{!}}The PSDK client truststore path for the UCS Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}psdk.truststores.gws-platform-voice-psdk-truststore
{{!}}The PSDK client truststore path for the GWS Voice Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}psdk.truststores.gws-platform-statistics-psdk-truststore
{{!}}The PSDK client truststore path for the GWS Statistics Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}psdk.truststores.truststores.gws-platform-datacollector-psdk-truststore
{{!}}The PSDK client truststore path for the GWS Data Collector Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}-
{{!}}psdk.gws-platform-ocs-psdk-truststore
{{!}}The PSDK client truststore path for the GWS OCS Service.
{{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
{{!}}""
{{!}}}
{{AnchorDiv|passwords}}
===Truststore passwords===
{{{!}} class="wikitable" style="table-layout: fixed; overflow-wrap: break-word;" {{!}}
!Parameter
!Description
!Valid values
!Default
{{!}}-
{{!}}psdk.passwords.gws-platform-configuration-psdk-truststore-password
{{!}}The PSDK client truststore password for the GWS Configuration Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}psdk.passwords.gws-platform-ixn-psdk-truststore-password
{{!}}The PSDK client truststore password for the GWS Interaction Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}psdk.passwords.gws-platform-chat-psdk-truststore-password
{{!}}The PSDK client truststore password for the Chat Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}psdk.passwords.gws-platform-ucs-psdk-truststore-password
{{!}}The PSDK client truststore password for the UCS Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}psdk.passwords.gws-platform-voice-psdk-truststore-password
{{!}}The PSDK client truststore password for the GWS Voice Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}psdk.passwords.gws-platform-statistics-psdk-truststore-password
{{!}}The PSDK client truststore password for the GWS Statistics Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}psdk.passwords.gws-platform-datacollector-psdk-truststore-password
{{!}}The PSDK client truststore password for the GWS Data Collector Service.
{{!}}A valid password
{{!}}""
{{!}}-
{{!}}psdk.passwords.gws-platform-ocs-psdk-truststore-password
{{!}}The PSDK client truststore password for the GWS OCS Service.
{{!}}A valid password
{{!}}""
{{!}}}
|Status=No
}}
}}

@@ Line 2: / Line 2: @@
 |Standalone=No
 |DisplayName=Configure connections with TLS and authentication
-|Context=Learn how to configure Transport Layer Security and Authentication for connections to third-party services and non-containerized Genesys servers.
+|Context=Learn how to configure Transport Layer Security and authentication for connections to third-party services and non-containerized Genesys servers.
 |ComingSoon=No
 |Section={{Section
@@ Line 21: / Line 21: @@
 *{{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=Configure|anchor= redis.enableTls |display text= redis.enableTls }}
-You must also define the truststore paths and passwords in the tables below:{{AnchorDiv|redis}}
+You must also define the following truststore paths and passwords in the '''values.yaml''' file:{{AnchorDiv|redis}}
 ===Redis===
 {{{!}} class="wikitable" style="table-layout: fixed; overflow-wrap: break-word;" {{!}}
@@ Line 108: / Line 108: @@
 {{!}}-
 {{!}}secretsTls.postgresprovisioning.enabled
-{{!}}Specifies whether a Kubernetes secret is created for the gws-app-provisioning TLS connection to PostgreSQL.
+{{!}}Specifies whether a Kubernetes secret is created for the Agent Setup TLS connection to PostgreSQL.
 {{!}}true or false
 {{!}}false
 {{!}}-
 {{!}}secretsTls.postgresprovisioning.truststores.gws-app-provisioning-postgres-truststore
-{{!}}The PostgreSQL client truststore path for gws-app-provisioning.
+{{!}}The PostgreSQL client truststore path for Agent Setup.
 {{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
 {{!}}""
 {{!}}-
 {{!}}secretsTls.postgresprovisioning.passwords.gws-app-provisioning-postgres-truststore-password
-{{!}}The PostgreSQL client truststore password for gws-app-provisioning.
+{{!}}The PostgreSQL client truststore password for Agent Setup.
 {{!}}A valid password
 {{!}}""
@@ Line 154: / Line 154: @@
 GWS services use [https://docs.genesys.com/Documentation/PSDK/9.0.x/Developer/TLSQuickStart upgrade mode ports] for TLS connections between Platform SDK and legacy Genesys services, which means you cannot enable TLS in the GWS '''values.yaml''' file. Instead, [https://docs.genesys.com/Documentation/PSDK/9.0.x/Developer/TLSTLSParametersinConfigManager configure the TLS parameters] in Configuration Server.
-You must also define the truststore paths and passwords in the tables below:
+You must also define the following truststore paths and passwords in the GWS '''values.yaml''' file:
 {{AnchorDiv|truststore}}
 ===Truststore paths===
@@ Line 179: / Line 179: @@
 {{!}}-
 {{!}}psdk.truststores.gws-platform-chat-psdk-truststore
-{{!}}The PSDK client truststore path for the Chat Service.
+{{!}}The PSDK client truststore path for the GWS Chat Service.
 {{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
 {{!}}""
 {{!}}-
 {{!}}psdk.truststores.gws-platform-ucs-psdk-truststore
-{{!}}The PSDK client truststore path for the UCS Service.
+{{!}}The PSDK client truststore path for the GWS UCS Service.
 {{!}}A valid path to the truststore file, relative to the '''gws-services''' directory.
 {{!}}""

@@ Line 6: / Line 6: @@
 |Section={{Section
 |alignment=Vertical
-|structuredtext=Web Services and Applications (GWS) supports secure connections to third-party services and legacy Genesys servers using Transport Layer Security (TLS).
+|structuredtext=Genesys Web Services and Applications (GWS) supports secure connections to third-party services and legacy Genesys servers using Transport Layer Security (TLS) version 1.2.
 To enable TLS, you must download and unpack the '''gws-services''' Helm chart locally. Next, create any required certificates for the services and put the truststores under the '''gws-services''' directory of the unpacked chart. For example: '''gws-services/crts/gwsPlatformSettingPostgresTrustore.p12.''' Following this example, the setting for the PostgreSQL truststore would be: <code>secretsTls.postgres.truststores.gws-plaftom-setting-postgres-truststore: crts/gwsPlatformSettingPostgresTrustore.p12</code>{{NoteFormat|When you {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=Deploy}}, make sure to point to your local files during the installation.|}}Next, configure TLS by overriding Helm chart values in the '''values.yaml''' file. See {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=ConfigureTLS|anchor=thirdpartyservices|display text=TLS for third-party services}} and {{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=ConfigureTLS|anchor=genesysservers|display text=TLS for legacy Genesys servers}} for details.
@@ Line 14: / Line 14: @@
 |anchor=thirdpartyservices
 |alignment=Vertical
-|structuredtext=GWS support TLS connections to the third-party services Redis, PostgreSQL, and Elasticsearch. To enable TLS for these services, set the following parameters in the '''values.yaml''' file:
+|structuredtext=GWS supports TLS connections to the third-party services Redis, PostgreSQL, and Elasticsearch. To enable TLS for these services, set the following parameters in the '''values.yaml''' file:
 *{{Link-SomewhereInThisVersion|manual=GWSPEGuide|topic=Configure|anchor=gwsServices.gwsAppProvisioning.postgres.enableTls|display text=gwsServices.gwsAppProvisioning.postgres.enableTls}}
@@ Line 150: / Line 150: @@
 |anchor=genesysservers
 |alignment=Vertical
-|structuredtext=GWS support TLS connections to legacy Genesys servers in a mixed mode environment. GWS uses the [https://docs.genesys.com/Documentation/PSDK Platform SDK] to connect to legacy Genesys servers, such as [https://docs.genesys.com/Documentation/FR Configuration Server], [https://docs.genesys.com/Documentation/IXN Interaction Server], [https://docs.genesys.com/Documentation/TS T-Server], [https://docs.genesys.com/Documentation/UCS Universal Contact Server], [https://docs.genesys.com/Documentation/RTME Stat Server], [https://docs.genesys.com/Documentation/ES Chat Server], and [https://docs.genesys.com/Documentation/OU Outbound Contact Server].
+|structuredtext=GWS supports TLS connections to legacy Genesys servers in a mixed mode environment. GWS uses the [https://docs.genesys.com/Documentation/PSDK Platform SDK] to connect to legacy Genesys servers, such as [https://docs.genesys.com/Documentation/FR Configuration Server], [https://docs.genesys.com/Documentation/IXN Interaction Server], [https://docs.genesys.com/Documentation/TS T-Server], [https://docs.genesys.com/Documentation/UCS Universal Contact Server], [https://docs.genesys.com/Documentation/RTME Stat Server], [https://docs.genesys.com/Documentation/ES Chat Server], and [https://docs.genesys.com/Documentation/OU Outbound Contact Server].
 GWS services use [https://docs.genesys.com/Documentation/PSDK/9.0.x/Developer/TLSQuickStart upgrade mode ports] for TLS connections between Platform SDK and legacy Genesys services, which means you cannot enable TLS in the GWS '''values.yaml''' file. Instead, [https://docs.genesys.com/Documentation/PSDK/9.0.x/Developer/TLSTLSParametersinConfigManager configure the TLS parameters] in Configuration Server.