Configuring Pivotal Platform SSL Termination for vSphere

Page last updated:

To use SSL termination in Pivotal Platform, you must configure the HAProxy load balancer or your own load balancer.

Pivotal recommends that you use HAProxy in lab and test environments only. Production environments should instead use a highly-available customer-provided load balancing solution.

Choose an SSL termination method to determine the steps you must take to configure Pivotal Application Service (PAS).

Use the HAProxy Load Balancer

Pivotal Platform deploys with a single instance of HAProxy for use in lab and test environments. You can use this HAProxy instance for SSL termination and load balancing to the PAS Gorouters. HAProxy can generate a self-signed certificate if you do not want to obtain a signed certificate from a well-known Certificate Authority (CA).

Note: Certificates generated in PAS are signed by the Ops Manager Certificate Authority. They are not technically self-signed, but they are referred to as “self-signed certificates” in the Ops Manager UI and throughout this documentation.

To use the HAProxy load balancer:

  1. Create an A record in your DNS that points to the HAProxy IP address. The A record associates the System domain and Apps domain that you configure in the Domains pane of the PAS tile with the HAProxy IP address.

    For example, with pcf.example.com as the main subdomain for your Pivotal Platform installation and an HAProxy IP address 203.0.113.1, you must create an A record in your DNS that serves example.com and points *.product_name_lc to 203.0.113.1.

    Name Type Data Domain
    *.pcf A 203.0.113.1 example.com
  2. Test your DNS entry by running:

    host
    

    This command should return your HAProxy IP address.

  3. Navigate to the Pivotal Operations Manager Installation Dashboard.

  4. Click the PAS tile.

  5. Select Networking.

  6. Leave the Gorouter IPs field blank. HAProxy assigns the Gorouter IPs internally.

  7. Enter the IP address for HAProxy in the HAProxy IPs field.

  8. Provide your SSL certificate in the Certificates and private keys for the Gorouter and HAProxy fields. For more information, see Providing a Certificate for Your TLS Termination Point.

Use Another Load Balancer

Production environments should use a highly-available customer-provided load balancing solution that:

  • Provides SSL termination with wildcard DNS location
  • Provides load balancing to each of the PAS Gorouter IPs
  • Adds appropriate x-forwarded-for and x-forwarded-proto HTTP headers

To use your own load balancer:

  1. Register one or more static IP address for Pivotal Platform with your load balancer.

  2. Create an A record in your DNS that points to your load balancer IP address. The A record associates the System domain and Apps domain that you configure in the Domains pane of the PAS tile with the IP address of your load balancer.

    For example, with pcf.example.com as the main subdomain for your Pivotal Platform installation and a load balancer IP address 198.51.100.1, you must create an A record in your DNS that serves example.com and points *.pcf to 198.51.100.1.

    Name Type Data Domain
    *.pcf A 198.51.100.1 example.com
  3. Navigate to the Pivotal Operations Manager Installation Dashboard.

  4. Click the PAS tile.

  5. Select Networking.

  6. In the Gorouter IPs field, enter the static IP address for Pivotal Platform that you have registered with your load balancer.

  7. Leave the HAProxy IPs field blank.

  8. Provide your SSL certificate in the Certificates and private keys for the Gorouter and HAProxy fields. For more information, see Providing a Certificate for Your TLS Termination Point.

Note: When adding or removing Pivotal Platform Gorouters, you must update your load balancing solution configuration with the appropriate IP addresses.