Configuring Pivotal Platform SSL Termination for vSphere

To use SSL termination in Pivotal Platform, you must configure the Pivotal-deployed HAProxy load balancer or your own load balancer.

Pivotal recommends that you use HAProxy in lab and test environments only. Production environments should instead use a highly-available customer-provided load balancing solution.

Choose an SSL termination method to determine the steps you must take to configure Pivotal Application Service (PAS).

Using the HAProxy Load Balancer

Pivotal Platform deploys with a single instance of HAProxy for use in lab and test environments. You can use this HAProxy instance for SSL termination and load balancing to the PAS Gorouters. HAProxy can generate a self-signed certificate if you do not want to obtain a signed certificate from a well-known certificate authority.

Note: Certificates generated in PAS are signed by the Operations Manager Certificate Authority. They are not technically self-signed, but they are referred to as “Self-Signed Certificates” in the Ops Manager GUI and throughout this documentation.

To use the HAProxy load balancer, you must create a wildcard A record in your DNS and configure three fields in the PAS product tile.

  1. Create an A record in your DNS that points to the HAProxy IP address. The A record associates the System domain and Apps domain that you configure in the Domains pane of the PAS tile with the HAProxy IP address.

    For example, with cf.example.com as the main subdomain for your CF install and an HAProxy IP address 203.0.113.1, you must create an A record in your DNS that serves example.com and points *.cf to 203.0.113.1.

    Name Type Data Domain
    *.cf A 203.0.113.1 example.com
  2. Use the Linux host command to test your DNS entry. The host command should return your HAProxy IP address.

    Example:

    $ host cf.example.com
    cf.example.com has address 203.0.113.1
    $ host anything.example.com
    anything.cf.example.com has address 203.0.113.1
    

  3. From the Pivotal Operations Manager Dashboard, click on the PAS tile.

  4. Select Networking.

  5. Leave the Router IPs field blank. HAProxy assigns the router IPs internally.

  6. Enter the IP address for HAProxy in the HAProxy IPs field.

  7. Provide your SSL certificate in the Certificates and private keys for HAProxy and Router fields. For more information, see Providing a Certificate for Your TLS Termination Point](./security_config.html).

Using Another Load Balancer

Production environments should use a highly-available customer-provided load balancing solution that does the following:

  • Provides SSL termination with wildcard DNS location
  • Provides load balancing to each of the PAS router IPs
  • Adds appropriate x-forwarded-for and x-forwarded-proto HTTP headers

You must register static IP addresses for Pivotal Platform with your load balancer and configure three fields in the PAS product tile.

  1. Register one or more static IP address for Pivotal Platform with your load balancer.

  2. Create an A record in your DNS that points to your load balancer IP address. The A record associates the System domain and Apps domain that you configure in the Domains pane of the PAS tile with the IP address of your load balancer.

    For example, with cf.example.com as the main subdomain for your CF install and a load balancer IP address 198.51.100.1, you must create an A record in your DNS that serves example.com and points *.cf to 198.51.100.1.

    Name Type Data Domain
    *.cf A 198.51.100.1 example.com
  3. From the Ops Manager Dashboard, click on the PAS tile.

  4. Select Networking.

  5. In the Router IPs field, enter the static IP address for Pivotal Platform that you have registered with your load balancer.

  6. Leave the HAProxy IPs field blank.

  7. Provide your SSL certificate in the Certificates and private keys for HAProxy and Router fields. For more information, see Providing a Certificate for Your TLS Termination Point](./security_config.html).

Note: When adding or removing Pivotal Platform routers, you must update your load balancing solution configuration with the appropriate IP addresses.