Front-end host, System Manager, and certificate configuration

Last Updated : Sep 03, 2021 |

If you do not select the Front-end host, System Manager and Certificate Configuration option during the installation, then the self-signed certificates are automatically generated. Self-signed certificates are also generated when:

  • The System Manager FQDN option is not set.

  • The Use System Manager for certificates option is set to n and certificates were not provided for one of the interfaces: REST, OAMP, or NODE.

You can modify certificate configuration settings from the administration portal anytime. This is useful if you do not complete the certificate configuration as part of the initial setup process or if you generate certificates at a later time.

For information about managing certificates through the Avaya Aura® Web Gateway administration portal, see the managing certificates section in Administering the Avaya Aura® Web Gateway.

Caution:

If the system is using System Manager for certificates, then changing the System Manager FQDN after installation will result in the regeneration of certificates. This might impact the client and backend server communication with the Avaya Aura® Web Gateway.

Table 1: Front-end host, System Manager and Certificate Configuration settings

Item name

Description

Equivalent installation.properties file parameter

Front-end FQDN

The front-end FQDN is the address that end-user clients use to access the services provided by Avaya Aura® Web Gateway .

For a cluster deployment, you must configure the front-end FQDN as the FQDN of the virtual IP address. If an external load balancer is used, set this value to the FQDN of the load balancer.

The default value depends on the configuration present in the /etc/hosts file of the server.

REST_FRONTEND_HOST

System Manager FQDN

The FQDN of the System Manager that signs the certificates.

SYSTEM_MGR_IP

System Manager web admin username (o)

The System Manager web administration portal user name.

SMGR_USER_NAME

System Manager web admin password

The System Manager web administration portal password.

SMGR_USER_PASSWORD

System Manager HTTPS Port

The HTTPS port used for the Alarm Agent for the current Avaya Aura® Web Gateway server.

The default value for this setting is 443.

SYSTEM_MGR_HTTPS_PORT

System Manager Enrollment Password

The System Manager enrollment password.

Note:

To get the password, log in to System Manager and navigate to Service > Security > Certificates > Enrollment Password.

SYSTEM_MGR_PW

Override port for remote access

Specifies the port on the Avaya Aura® Web Gateway server. This port is used by a reverse proxy, such as Avaya SBC, that fronts HTTP-based clients which are external to the enterprise.

The reverse proxy continues to receive requests from the external clients on port 443, and then forwards them to the Avaya Aura® Web Gateway on the reverse proxy port. Clients within the enterprise continue to access Avaya Aura® Web Gateway directly using port 443.

Select y (yes) to configure the port for the reverse proxy server or n (no) to keep the default configuration that remains disabled.

Important:

If this setting is enabled, you cannot set the port to 443, but you can set it to 8444, which is the default setting, or to any other port.

If you select y (yes), the menu displays a new setting for the reverse proxy port: Front-end port for reverse proxy.

If you override the port for remote access, you must configure this port on the Avaya SBC external interface for Avaya Aura® Web Gateway. For more information, see Administering Avaya Session Border Controller.

Note:

You can also set this port on the Avaya Aura® Web Gateway administration portal under External Access > HTTP Reverse Proxy. After selecting the Front-end port for remote access check box, you can modify the port value.

OVERRIDE_FRONTEND_PORT

For the Front-end port for reverse proxy setting, the equivalent parameter is REST_FRONTEND_PORT.

Use System Manager for certificates

Specifies if the certificates are retrieved from System Manager or from imported files.

Select y (yes) to retrieve certificates from System Manager or n (no) to retrieve certificates from imported files.

If you select n (no), the menu displays new settings for configuring the certificate files. To configure the certificate settings, you must provide the complete file path name to the:

USE_SMGR

If the USE_SMGR option is set to n (no), you must configure the following parameters for importing the certificate files:

  • REST_KEY_FILE

  • REST_CRT_FILE

  • OAM_KEY_FILE

  • OAM_CRT_FILE

  • NODE_KEY_FILE

  • NODE_CRT_FILE

  • CA_CRT_FILE

Local frontend host

The local FQDN of the node.

The configuration utility uses this value to generate certificates for the node.

Important:

In a clustered configuration, the local front-end host is different from one node to the other and is also different from the front-end FQDN. In a non-clustered environment, the local front-end host is usually different from the front-end FQDN to create a clustered configuration from a non-clustered configuration.

LOCAL_FRONTEND_HOST

Keystore password

The keystore password for the MSS and Tomcat certificates.

The minimum length for this password is 6 characters. The characters supported for the keystore password are:

KEYSTORE_PW