HTTP-Server

Rodias guarantees that the currently maintained insight-Versions are running and work together with the latest version of Apache HTTP Server.

Please make sure that the Apache HTTP server installation always contains the latest serurity-patches and -updates.

Installation

• Install Apache 2.4.x on your server

  • Downloads: https://httpd.apache.org/download.cgi#apache24
    • Minimum required version is v2.4
    • Use latest available stable version
    • Prefered download is from ApacheHaus

• Prefered installation path: D:\GiS\Insight\Apache

Include Insight configuration

• Copy the „httpd-config/insight-maximo.conf" from the „Insight Middleware.zip" to …\Apache\conf

• Edit …\Apache\conf\httpd.conf

• Add the following line at the end oft the file or in the corresponding definition

  Include conf/insight-maximo.conf
  

• Edit …\Apache\conf\insight.conf and adapt values of the properties if needed

Install as service

• Execute

  D:\GiS\Insight\Apache\bin\httpd.exe -k install
  

• Configure the newly created "Apache" service from manual to automatic

• Start the service

HTTPS

For the communication between mobile devices (iOS and Android) and insight-middleware it is necessary to configure HTTPS.

A server-certificate is required for the HTTPS.

All clients must be able to validate the list of SSL certificates involved, from the leaf (server) to the root (certification authority).

See chapter HTTPS Configuration for further steps.

HTTPS Configuration

Preparation:

• Copy the server certificate and key file to: .../conf/ssl/server.example.domain.crt and .../conf/ssl/server.example.domain.key
  • Use appropriate names for the files matching your setup / FQDNs used

Basic configuration:

• Edit .../conf/extra/httpd-ahssl.conf

• Comment all \<VirtualHost ..... :443\> configurations except for the _default_

• For the _default_ configuration:

  • Change ServerName to the external FQDN that server will be used with

  • If multiple FQDNs are used add more by using the ServerAlias property

  • Change SSLCertificateFile"${SRVROOT}/conf/ssl/server.example.domain.crt"

  • Change SSLCertificateKeyFile"${SRVROOT}/conf/ssl/server.example.domain.key"

See also: https://httpd.apache.org/docs/2.4/ssl/ssl_faq.html

Example:

Certificate chain:

If your certificate chain has (multiple) intermediate ca certificates you need to add all of them to your SSLCertificateFile configured above.

Steps:

• Export ca certificates with browser

• Convert them to PEM

  • Online service: https://www.sslshopper.com/ssl-converter.html

• Add them, from leaf (server) to root (top CA), to your SSLCertificateFile

HTTPS Verification & FAQ

After configuring the httpd service check the connection with any browser,

We recommand using Google Chrome as this is used by the mobile app as well.

Your browser window should look like this, especially the closed locked should not be open and/or red!

If any issues occur you can use the following tools / services to investigate them:

• https://www.ssllabs.com/ssltest/

• https://ssl-trust.com/SSL-Zertifikate/check

• https://github.com/nabla-c0d3/sslyze

  • Example: ./sslyze.exe --regular your.hostname.tld:443

• openssl (also part of Apache httpd)

• Examples:
  • openssl.exe s_client -showcerts -connect your.hostname.tld:443
  • openssl.exe s_client -tls1_3 -showcerts -connect your.hostname.tld:443

Further readings:

• https://www.heise.de/security/artikel/Chrome-blockt-Zertifikate-mit-Common-Name-3717594.html

Configuration IBM HTTP Server for Maximo

• In order to run Insight Web and/or Insight Mobile you need to extend the existing httpd.conf. After making the changes make sure to restart the „IBM HTTP Server“-Service.

Include Insight Configuration

• Copy the „httpd-config/insight-maximo.conf“ from the „Insight Middleware.zip“ to …/IBM/HTTPServer/conf
• Edit your x:\IBM\HTTPServer\conf\httpd.conf

• Add the following line at the end oft the file or in the corresponding <vhost> definitionE

      Include conf/insight-maximo.conf
  

• Edit x:\IBM\HTTPServer\conf\insight-maximo.conf and adapt values of the properties if needed

Restart IBM HTTP-Server

• Restart „IBM HTTP Server“-Service to activate the changes.