Secure PLOSSYS Administrator¶

For security reasons, we strongly recommend configuring the TLS encryption. This is also one step to get rid off the annoying certificate warnings in the browser. We also recommend using a regenerated client secret different to the one contained in delivery.

Configure the TLS Encryption¶

Get the TLS certificate in PEM format, see the Requirement. For securing the connection to PLOSSYS Administrator, the certificate has to contain the server name of PLOSSYS 5.
Save the private key and the public certificate in the C:\ProgramData\SEAL Systems\config\tls directory:
```
C:\ProgramData\SEAL Systems\config\tls\key.pem
```
```
C:\ProgramData\SEAL Systems\config\tls\cert.pem
```
Save the CA certificate (if available) to the following file in the same directory:
```
C:\ProgramData\SEAL Systems\config\tls\ca.pem
```
Set the following key to the path of the certificate files:
- TLS_PADIR: Directory for storing the files necessary for secure transfer with the PLOSSYS Administrator.
Example - setting key via PLOSSYS CLI
```
plossys config set TLS_PADIR "C:\ProgramData\SEAL Systems\config\tls" --service plossysadmin --insecure
```
If self-signed certificates are used with PLOSSYS Administrator, the following key has to be set to 0 for the seal-plossysadmin service:
- NODE_TLS_REJECT_UNAUTHORIZED: Flag if self-signed certificates are allowed
Example - setting key via PLOSSYS CLI
```
plossys config set NODE_TLS_REJECT_UNAUTHORIZED 0 --service plossysadmin --insecure
```
Restart the following service:
- seal-plossysadmin
Close PLOSSYS Administrator and open it again.

Configure the TLS Encryption in a Cluster¶

If you are running PLOSSYS 5 in a cluster, execute the configuration steps above on all PLOSSYS 5 servers. Thereby, use the same directory for the certificate files so that TLS_PADIR is valid on all PLOSSYS 5 servers.

Regenerate the Client Secret in the OIDC Identity Provider¶

In the OIDC identity provider, regenerate the secret for the seal-plossysadmin client, refer to the SEAL Interfaces for OIDC documentation.
In the configuration of the seal-plossysadmin service, specify the regenerated client secret with the following key:
- AUTH_CLIENT_SECRET: Client secret generated in the OIDC identity provider for the seal-plossysadmin client

Next Step¶

Continue with: Secure the PLOSSYS 5 Services