Install SSL Certificate

A valid SSL certificate for the FQDN where the Trifacta Application is hosted

Root access to the Alteryx server

Designer Cloud Powered by Trifacta platform is up and running

Log into the Alteryx server as the centos user. Switch to the root user:

sudo su

Enable the proxy nginx service so that it starts on boot:

systemctl enable nginx

Create a folder for the private key and limit access to it:

sudo mkdir /etc/ssl/private/ && sudo chmod 700 /etc/ssl/private

Copy the following files to the server. If you copy and paste the content, please ensure that you do not miss characters or insert unwanted characters.

1. The .key file should go into the /etc/ssl/private/ directory.

2. The .crt file and the CA bundle/intermediate certificate bundle should go into the /etc/ssl/certs/ directory.

   Note

   The delivery name and format of these files varies by provider. Please verify with your provider's documentation if this is unclear.

3. Your certificate and the intermediate/authority certificate must be combined into one file for nginx. Here is an example of how to combine them together:

   cat example_com.crt bundle.crt >> ssl-bundle.crt

Update the permissions on these files. Modify the following filenames as necessary:

sudo chmod 600 /etc/ssl/certs/ssl-bundle.crt
sudo chmod 600 /etc/ssl/private/your-private-cert.key

Use the following commands to deploy the example SSL configuration file provided on the server:

cp /opt/trifacta/conf/ssl-nginx.conf.sample /etc/nginx/conf.d/trifacta.conf && \
rm /etc/nginx/conf.d/default.conf

Edit the following file:

/etc/nginx/conf.d/trifacta.conf

Please modify the following key directives at least:

server_name

ssl_certificate

ssl_certificate_key

Example file:

server {
  listen          443;
  ssl             on;
  server_name     EXAMPLE.CUSTOMER.COM;
  # Don't limit the size of client uploads.
  client_max_body_size 0;
  access_log      /var/log/nginx/ssl-access.log;
  error_log       /var/log/nginx/ssl-error.log;
  ssl_certificate      /etc/ssl/certs/ssl-bundle.crt;
  ssl_certificate_key  /etc/ssl/certs/EXAMPLE-NAME.key;
  ssl_protocols        TLSv1.2 TLSv1.3;
  ssl_ciphers RC4:HIGH:!aNULL:!MD5;
  ssl_prefer_server_ciphers on;
  keepalive_timeout    60;
  ssl_session_cache    shared:SSL:10m;
  ssl_session_timeout  10m;
  location / {
    proxy_pass  http://localhost:3005;
    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
    proxy_set_header        Accept-Encoding   "";
    proxy_set_header        Host            $host;
    proxy_set_header        X-Real-IP       $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto $scheme;
    add_header              Front-End-Https   on;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_redirect     off;
  }
  proxy_connect_timeout       6000;
  proxy_send_timeout          6000;
  proxy_read_timeout          6000;
  send_timeout                6000;
}
server {
  listen          80;
  return 301 https://$host$request_uri;
}

Save the file.

To apply the new configuration, start or restart the nginx service:

service nginx restart

You can apply this change through the Admin Settings Page (recommended) or trifacta-conf.json. For more information, see Platform Configuration Methods.

Locate the following setting and change its value to true:

"proxy.securityHeaders.httpsHeaders": false,

Save your changes and restart the platform.

You can apply this change through the Admin Settings Page (recommended) or trifacta-conf.json. For more information, see Platform Configuration Methods.

Locate the following setting and change its value to true:

"webapp.session.cookieSecureFlag": false,

Save your changes and restart the platform.

Copy in the new certificate to the Trifacta node.

Edit the nginx configuration file:

/etc/nginx/conf.d/trifacta.conf

In the configuration file, replace the values for the following settings to point to the new certificate:

1. ssl_certificate

2. ssl_certificate_key

3. For more information, see "Configure nginx" above.

Save the file, and restart the platform.