ON THIS PAGE
 

Configuring Apstra Flow Data Center TLS Certificates

This guide describes how to configure Apstra Flow DC Director TLS certificates. Transport Layer Security (TLS) certificates, commonly known as SSL or digital certificates, are configured in OpenSearch dashboards.

Certificate Requirements

Obtain the following files from the Certificate Authority (CA) before you begin the configuration:

Table 1: TLS Certificate Requirements
Type of Certificate Description Filename(s)
CA Root Certificate Self-signed digital certificate issued by a trusted CA that acts as the top-level "trust anchor" in a public key infrastructure (PKI) hierarchy.

  • root-ca.pem
Node Certificate Certificate pair for the OpenSearch server (used for all internal and external communication).

  • osnode.pem

  • osnode-key.pem
Admin Certificate (Optional)

Separate certificate pair for administrative use such as running the securityadmin.sh tool.

Note: The Admin Certificate requires a specific Distinguished Name (DN), defined in OpenSearch to grant super-admin rights.

  • osadmin.pem

  • osadmin-key.pem
Note: If you rename any of the certificate file(s) referenced in Table 1 , you must update your YAML file with the changed names.

OpenSearch TLS Setup

Note: These steps are for a single node setup.
  1. Copy the following certificate files to the /etc/opensearch/ directory:

    • root-ca.pem

    • osnode.pem

    • osnode-key.pem

    • osadmin-key.pem

    • osadmin.pem

    Note:

    If you're using the Apstra DC Director login, you must change permissions of the /etc/opensearch directory to allow the Apstra account.
  2. Set permissions for key files (osnode-key.pem and osadmin-key.pem) to 640. This restriction ensures only the OpenSearch user can access these files.
  3. Change the file ownership to opensearch:opensearch if needed.

    • For permissions, use: chmod 640 <filename>

    • For ownership, use: chown opensearch:opensearch <filename>

Update the OpenSearch Configuration

  1. Edit the /etc/opensearch/opensearch.yml file to point to your new files. Define the Admin and Node identities in the same file.
  2. Collect the subject information from the certificates. Extract the subject line from the node and admin certificates and save the output.
    For example:
  3. Add plugins.security.nodes_dn with the node certificate subject.
  4. (Optional) Add plugins.security.authcz.admin_dn with the admin certificate subject.
  5. Verify that the following certificate and key references point to the correct file.

Start the OpenSearch Service

  1. To start the OpenSearch service, enter the command sudo systemctl start opensearch.service.
  2. Check the current status.
    sudo systemctl status opensearch.service
  3. Check the log file.
    /var/log/opensearch/apstra-flow.log
  4. Verify that the URL is correct with the curl command:
    The following example shows the Apstra Flow opensearch.yaml file that contains the key and certificate settings.

Configure the OpenSearch Dashboards

  1. Edit the /etc/opensearch-dashboards/opensearch_dashboards.yml file to enable TLS for browser access. This action establishes a secure connection to OpenSearch.

    • Modify opensearch.host so the URL starts with https://.

    • Set opensearch.ssl.certificateAuthorities to /etc/opensearch-dashboards/root-ca.pem.

    • Set server.ssl.enabled to true.

    • Set server.ssl.certificate to /etc/opensearch-dashboards/osnode.pem.

    • Set server.ssl.key to /etc/opensearch-dashboards/osnode-key.pem.

    For example:
  2. Start the OpenSearch service to apply the configuration.
    sudo systemctl start opensearch-dashboards.service
  3. Check the service status.
    sudo systemctl status opensearch-dashboards.service
  4. Ensure the service is running, then log in at https://<server name/IP>:5601.
    Note: The opensearch-dashboards.yml file has two commented-out lines for enabling logging. If the opensearch-dashboards.service fails to start, check any errors using journalctl -n 100 -u opensearch-dashboards.service. Alternatively, uncomment the logging lines and restart the service.