When you log on to Web ODC in a browser over HTTP for the first time, you will receive a message indicating that the connection is not secure. To ensure access security, you can deploy an SSL certificate to access ODC over HTTPS. You can apply for a CA certificate or configure an HTTPS self-signed certificate. If you do not want to access ODC over HTTPS, you can skip this step and directly deploy NGINX.
Apply for a CA certificate
To apply for a CA certificate, we recommend that you purchase an SSL certificate and an SSL certificate service on Alibaba Cloud. For more information, see SSL certificate.
In the intranet environment, you can consult your IT administrator for the procedure of applying for a CA certificate.
Configure an SSL self-signed certificate
The ODC image package contains an executable file that can generate a certificate and private keys: generate-odc-ssl-certificate.sh. You can run this file on the host to generate a certificate. The self-signed certificate can implement encrypted communication. However, an OS does not trust a self-signed certificate by default. You can add the certificate to the Trusted Root Certificate Authorities in the browser to configure certificate trust.
The following code shows how to run the executable file. The value for domain must be consistent with the domain name used by your ODC. Otherwise, the browser considers that the certificate does not match the site.
$./generate-odc-ssl-certificate.sh
Enter your domain [www.example.com]:
Enter your province [Zhejiang]:
Enter your city [Hangzhou]:
Enter your company name [OceanBase]:
Enter your company unit name [DBA]:
generate certificate...
Generating a 2048 bit RSA private key
.......................................+++
.......................
......+++
writing new private key to '/etc/pki/nginx/odcserver.key'
-----
end of string encountered while processing type of subject name element #5
problems making Certificate Request
check generated files:
-rw-r--r-- 1 root root 1424 Jun 3 15:18 server.crt
-rw-r--r-- 1 root root 1708 Jun 3 15:18 server.key
The following code shows the content of the generate-odc-ssl-certificate.sh file. You can directly run the following command to generate a self-signed certificate.
#!/usr/bin/env bash
# for generate self certificated ssl certificate files
echo try create directory '/etc/pki/nginx' if not exists...
sudo mkdir -p /etc/pki/nginx
cd /etc/pki/nginx || exit
#read configurations
read -rp "Enter your domain [www.example.com]: " DOMAIN
read -rp "Enter your province [Zhejiang]: " PROVINCE
read -rp "Enter your city [Hangzhou]: " CITY
read -rp "Enter your company name [OceanBase]: " COMPANY
read -rp "Enter your company unit name [DBA]: " UNIT
echo generate certificate...
SUBJ="/C=CN/ST=${PROVINCE}/L=${CITY}/O=${COMPANY}/OU=${UNIT}/CN=${DOMAIN}"
sudo openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
-keyout /etc/pki/nginx/odcserver.key \
-out /etc/pki/nginx/odcserver.crt \
-subj "${SUBJ}"
echo "check generated files (use ls -l odcserver.*):"
ls -l odcserver.*