DOCS-2202 SSL termination - final version#1933
DOCS-2202 SSL termination - final version#1933egoverdovskaya-wallarm wants to merge 1 commit intomasterfrom
Conversation
✅ Deploy Preview for pensive-dubinsky-5f7a00 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
|
||
| # SSL/TLS Termination and Certificate Management (Self-Hosted Nodes) | ||
|
|
||
| This article describes how SSL/TLS termination and certificate management work in self-hosted Wallarm nodes (including NGINX and Native Nodes), and how HTTPS traffic is processed for analysis. |
There was a problem hiding this comment.
"NGINX and Native Nodes" - add the link to https://docs.wallarm.com/installation/nginx-native-node-internals/
| [security-edge]: ../installation/security-edge/overview.md | ||
| [aws-ami]: ../installation/cloud-platforms/aws/ami.md | ||
| [gcp]: ../installation/cloud-platforms/gcp/machine-image.md | ||
|
|
There was a problem hiding this comment.
the question which is not covered by the article - how do a customer choose where SSL/TLS termination should happen?
| [aws-ami]: ../installation/cloud-platforms/aws/ami.md | ||
| [gcp]: ../installation/cloud-platforms/gcp/machine-image.md | ||
|
|
||
|
|
There was a problem hiding this comment.
the article is currently missing the details on mTLS. it is probably a separate task but we need to describe the way the Node proxies traffic further - plan HTTPS/HTTPS and how to configure it
|
|
||
| You need to: | ||
|
|
||
| 1. Issue a certificate from a trusted Certificate Authority (CA) for a Wallarm Node instance. |
There was a problem hiding this comment.
for a Wallarm Node instance? usually, the certificate is requested for protected endpoints, not the Node instance. for example, in the article for sidecar, we ask a user to request certificates for "the server for which the Sidecar will terminate SSL/TLS" https://deploy-preview-1933--pensive-dubinsky-5f7a00.netlify.app/installation/kubernetes/sidecar-proxy/customization/#ssltls-termination
|
|
||
| To automate these actions, you can use external tools, e.g., [Certbot](https://certbot.eff.org/), [HashiCorp Vault](https://developer.hashicorp.com/vault), [Kubernetes cert-manager](https://cert-manager.io/), [Ansible playbooks](https://docs.ansible.com/projects/ansible/devel/playbook_guide/playbooks_intro.html), or others. | ||
|
|
||
|  |
There was a problem hiding this comment.
|  | |
|  |
|
|
||
|
|
||
| # SSL/TLS Termination and Certificate Management (Self-Hosted Nodes) | ||
|
|
There was a problem hiding this comment.
Avoid narrowing the scope to “HTTPS” in conceptual sections: since Wallarm also analyzes WebSocket, gRPC, etc., use broader wording like “SSL/TLS-protected application traffic” or “application-layer traffic” instead of “HTTPS traffic” where possible.
| ``` | ||
|
|
||
| 1. Monitor the certificate's validity and renew it before expiration. | ||
|
|
There was a problem hiding this comment.
after the NGINX config steps, include basic verification steps like config test, confirm Wallarm receives traffic
| proxy_pass https://10.100.100.30; # Replace with the IP address of the origin server | ||
| proxy_set_header Host $host; | ||
| proxy_set_header X-Forwarded-For $remote_addr; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
There was a problem hiding this comment.
why is proxy_set_header specified twice?
|
|
||
| To automate these actions, you can use external tools, e.g., [Certbot](https://certbot.eff.org/), [HashiCorp Vault](https://developer.hashicorp.com/vault), [Kubernetes cert-manager](https://cert-manager.io/), [Ansible playbooks](https://docs.ansible.com/projects/ansible/devel/playbook_guide/playbooks_intro.html), or others. | ||
|
|
||
|  |
There was a problem hiding this comment.
comments for the diagram:
- or Firewall or WAF - just keep "Firewall" because WAF is a firewall. inctead of "WAF" here can be "Ingress Controller" for example. and it is good to add "etc." to the list of upstream components
- the concept of the diagram is unclear. for example, see the diagram for mTLS in SE inline https://docs.wallarm.com/installation/security-edge/inline/mtls/ - it clearly describes the stages of decryption. I would say that the current diagram also should reflect that
- I would create 2 diagrams: one is for decryption on the upstream level and another is for decryption on the Node
2 participants
No description provided.