Providing a Certificate for Your TLS Termination Point

Page last updated:

This topic describes how to configure Transport Layer Security (TLS) termination for HTTP traffic in Pivotal Application Service (PAS) with a TLS certificate, as part of the process of configuring PAS for deployment.

Configure TLS Termination

When you deploy PCF, you must configure the TLS termination for HTTP traffic in your PAS configuration. You can terminate TLS at all of the following points:

  • Load Balancer
  • Load Balancer and Gorouter
  • Gorouter

Follow the guidance in Securing Traffic into PAS to choose and configure the TLS termination option for your deployment.

Note: If you are using HAProxy in a PCF deployment, you can choose to terminate SSL/TLS at HAProxy in addition to any of the SSL/TLS termination options above. For more information, see Configuring SSL/TLS Termination at HAProxy.

Obtain TLS Certificates

To secure traffic into PCF, you must obtain at least one TLS certificate. For general certificate requirements for deploying PCF, see the Certificate Requirements section of the Securing Traffic into PAS topic.

See the following sections for additional IaaS-specific certificate requirements:

Creating a Wildcard Certificate for PCF Deployments

This section describes how to create or generate a certificate for your PAS environment. If you are deploying to a production environment, you should obtain a certificate from a trusted authority (CA).

For internal development or testing environments, you have two options for creating a required TLS certificates.

  • You can create a self-signed certificate, or
  • You can have PAS generate the certificate for you.

To create a certificate, you can use a wide variety of tools including OpenSSL, Java’s keytool, Adobe Reader, and Apple’s Keychain to generate a Certificate Signing Request (CSR).

In either case for either self-signed or trusted single certificates, apply the following rules when creating the CSR:

  • Specify your registered wildcard domain as the Common Name. For example, *

  • If you are using a split domain setup that separates the domains for apps and sys components (recommended), enter the following values in the Subject Alternative Name of the certificate:

    • *
    • *
    • *
    • *
  • If you are using a single domain setup, use the following values as the Subject Alternative Name of the certificate:

    • *
    • *

    Note: TLS certificates generated for wildcard DNS records only work for a single domain name component or component fragment. For example, a certificate generated for * does not work for * and * The certificate must have both * and * attributed to it.

Generating an RSA Certificate in PAS

To generate an RSA certificate in PAS:

  1. Navigate to the Ops Manager Installation Dashboard.

  2. Click the Pivotal Application Service tile.

  3. Select Networking.

  4. Click Change underneath the Certificate and private key for HAProxy and Router fields, then click Generate RSA Certificate to populate the Certificate and private key for HAProxy and Router fields with RSA certificate and private key information.

  5. If you are using a split domain setup that separates the domains for apps and sys components (recommended), enter the following domains for the certificate:

    • *
    • *
    • *
    • *
    • *

    For example, *, *, *, *, *

    At the top of the pop-up window is a teal checkmark and the words 'Generate RSA Certificate'. In the upper-right corner is a gray circle with a white X in the middle. Below 'Generate RSA Certificate' is a field labeled 'Example: *, *, *, *,,', with a red asterisk to denote that it is a required field. The field contains the text '*, *'. Below this field are two buttons, a gray rectangular button labeled 'Cancel' and a blue rectangular button labeled 'Save'.