This documentation is for WSO2 IoT Server 3.0.0. View the documentation for the latest release.
Due to a known issue do not use JDK1.8.0_151 with WSO2 products. Use JDK 1.8.0_144 until JDK 1.8.0_162-ea is released.
Page Comparison - Configuring WSO2 IoT Server with the IP or Hostname (v.43 vs v.68) - IoT Server 3.0.0 - WSO2 Documentation
IoT Server 3.0.0
Expand all   Collapse all

Versions Compared

Old Version 43

changes.mady.by.user Yvonne Wickramasinghe

Saved on

compared with

New Version Current

changes.mady.by.user Yvonne Wickramasinghe

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Note

WSO2 IoT Server supports Secure Socket Layer (SSL), which establishes an encrypted channel between a client and a server. SSL enables a client to verify its reciprocal server as a trusted entity using digital signatures. With SSL in place, when a client tries to access a When SSL is used, the following takes place:

  • The client attempts to access the server using the server URL, and requests for the

server sends a response (SSL handshake) in return. The client then verifies whether the CN attribute (of the underlying certificate) sent in the response matches with the server URL or not. When the CN attribute does not match with

  • server identity.

  • The server responds with a copy of its certificate and the public key.

  • The client verifies the validity of the certificate and whether its Common Name (CN), which identifies the server hostname, matches with the server URL. If the certificate gets validated, the client creates an encrypted symmetric session key using the public key sent by the server and sends it to the server.

  • The server decrypts the session key sent by the client and sends an acknowledgment to the client encrypted by the session key.

  • Once, the client receives the acknowledgment key, an encryption session is created between the client and the server.

When the CN does not match with the server URL, the client fails to connect to the server. In this case, the client gets a hostname verification failure. Therefore, when running WSO2 IoT Server in a clustered environment, it is essential to configure the correct IP or hostname.

Let's take a look at the steps you need to follow to configure WSO2 IoT Server with the IP or hostname:

Tip
titleBefore you begin

You need to open the ports listed

under 

under Required

Ports

ports for WSO2 IoT Server for WSO2 IoT Server to connect

following messaging systems, and enroll devices:Android:

to Google Cloud Messaging (GCM)

,

/Firebase Cloud Messaging (FCM)

iOS:

and Apple Push Notification Service (APNS), and enroll devices.

-

certificate file when prompted:

  • Common Name (CN)

  • Organizational Unit (OU)
  • Organization (O)
  • Locality (L)
  • StateofProvince Name (S)

  • Country Name (C)

Excerpt

  1. Replace the default certificate with a new self-signed certificate, and import it to the client-truststore.jks by following the steps below:

    1. Navigate to <IoT_HOME>/core/repository/resources/security via command prompt.

    2. Delete the existing wso2carbon.jks certificate file.

      Code Block
      keytool -delete -alias wso2carbon -keystore wso2carbon.jks

    3. Create a new wso2carbon.jks certificate file.

      Code Block
      keytool -genkey -alias wso2carbon -keyalg RSA -keysize 2048 -keystore wso2carbon.jks

      Setup the hostname by configuring providing the following certificate attributes on for the newly created wso2carbon.jks file.

      Info
      titleCertificate Attributes

      CN: Common Name, OU: Organizational Unit, O: Organization, L: Locality, S: State or Province Name, and C: Country Name.

      Example:

Code Block
Code Block
titleSingle command to create the certificate and set certificate attributes
collapsetrue
keytool -genkey -alias wso2carbon -keyalg RSA -keysize 2048 -keystore wso2carbon.jks -dname "CN=wsstjo10wso2,OU=Home,O=Home,L=SL,S=WS,C=LK" -storepass wso2carbon -keypass wso2carbon

  • Replace the public key that is with the -alias wso2carbon available in the client-trustore.jks file, with the public key in of the newly generated certificate. The default public key used by all WSO2 IoT Server certificates is wso2carbon.

    Code Block
    keytool -delete -alias wso2carbon -keystore client-truststore.jks
keytool -export -alias wso2carbon -keystore wso2carbon.jks -file wso2carbon.pem
keytool -import -alias wso2carbon -file wso2carbon.pem -keystore client-truststore.jks -storepass wso2carbon

  • Convert the.pem file associated with the newly created certificate into a readable.pem file.

    Code Block
    keytool -exportcert -keystore wso2carbon.jks -alias wso2carbon
    asdfasdfas
     -file exportcert.pem
openssl x509 -inform der -in <<file name>> -out <<file name>>
    Note

    -in <<file name>>: This is the .pem file associated with the newly created certificate.

    -out <<file name>>: This is a preferred name to identify the .pem, which is used to view the certificate content.

    Example:

    Code Block
    keytool -exportcert -keystore wso2carbon.jks -alias wso2carbon -file exportcert.pem
openssl x509 -inform der -in exportcert.pem -out certificate.pem

  • Open the readable.pem file at <IOT_HOME>/core/repository/conf/identity/identity-providers/iot_default.xml via the vi/vim editor, and copy the content.

    Note

    When copying the content please ensure to exclude the BEGIN CERTIFICATE and END CERTIFICATE.

    Image Added

  • Navigate to the <IoT_HOME>/core/repository/conf/identity/identity-providers/iot_default.xml file and paste the content between the <Certificate> and </Certificate> tags.

  • Next, copy the client-truststore.jks and wso2carbon.jks to Broker and Analytics profile locations mentioned below.

    1. Broker: <IoT_HOME>/broker/repository/resources/security/

    2. Analytics: <IoT_HOME>/analytics/repository/resources/security/

  • Open the <IoT_HOME>/conf/carbon.xml file 

    1. If you configuring WSO2 IoT Server with the IP, comment out the <HostName> and <MgtHostName> attributes.

      Code Block
      <!--<HostName>localhost</HostName>-->
<!--<MgtHostName>localhost</MgtHostName>-->

    2. If you are configuring WSO2 IoT Server with the hostname, define the hostname as the value for the <HostName>and <MgtHostName> attributes.

      Code Block
      <HostName>{ENTER_THE_HOSTNAME}</HostName>
<MgtHostName>{ENTER_THE_HOSTNAME}</MgtHostName>

  • Open the <IOTS_HOME>/core/bin/wso2server.sh file and configure the following properties by replacing localhost with the  <IoT_SERVER_IP/HOSTNAME>.

    Code Block
    -Diot.core.host="<IoT_SERVER_IP/HOSTNAME>" \
-Diot.keymanager.host="<IoT_SERVER_IP/HOSTNAME>" \
-Diot.gateway.host="<IoT_SERVER_IP/HOSTNAME>" \
  • Open the <IOTS_HOME>/core/repository/conf/identity/sso-idp-config.xml file, and find . Find and replace localhost withthe  with the <IoT_SERVER_IP/HOSTNAME>.

  • Open the <IOTS_HOME>/core/repository/conf/app-manager.xml

      file

    file, and configure the <IdentityProviderUrl>

     attribute that is under <SSOConfiguration> byreplacing

     attribute under the <SSOConfiguration> by replacing localhost with the IoT Server IP.

    Code Block
    <!-- URL of the IDP use for SSO -->
<IdentityProviderUrl>https://<IoT_SERVER_IP/HOSTNAME>:${mgt.transport.https.port}/samlsso</IdentityProviderUrl>

  • Open the <IOTS_HOME>/core/repository/conf/etc/webapp-publisher-config.xml file, and set true as the value for <EnabledUpdateApi> parameter.

    Code Block
    <!-- If it is true, the APIs of this instance will be updated when the webapps are redeployed -->
<EnabledUpdateApi>true</EnabledUpdateApi>
    Info

    If you have not started WSO2 IoT Server previously, you

    don't

    do not need this configuration. When the server starts for the first time, it

    will update

    updates the APIs and web apps with the new server IP.

    Note

    Make sure to configure this property back to false if you need to restart the server again after the configuring the IP.

    By enabling the update API property

    you will be updating

    , the APIs and the respective web apps

    with the server IP

    get updated when the server restarts. This takes some time

    , therefore

    . Therefore, if you need to restart the server many times after this configuration or when in a production environment, you need to revert back to the default setting.

  • Open the <IOTS_HOME>/core /repository/deployment/server/jaggeryapps/devicemgt/app/conf/app-conf.json file, and configure the following attributes:

    1. identityProviderUrl: Replace %iot.keymanager.host%:%iot.keymanager.https.port% with the IoT Server IP or hostname and port, which is 9443.

      Code Block
      "identityProviderUrl" : "https://<IoT_SERVER_IP/HOSTNAME>:9443/samlsso",

    2. acs: Replace %iot.keymanager.host%:%iot.keymanager.https.port% with the IoT Server IP or hostname and port, which is 9443.

      Code Block
      "acs": "https://<IoT_SERVER_IP/HOSTNAME>:9443/devicemgt/uuf/sso/acs",

  • Open the <IOTS_HOME>/core/repository/deployment/server/jaggeryapps/api-store/site/conf/site.json file, and configure the identityProviderUrl attribute by replacing localhost with the IoT Server IP or hostname.

    Code Block
    "identityProviderURL" : "https://<IoT_SERVER_IP/HOSTNAME>:9443/samlsso",

  • Open the <IOTS_HOME>/analytics/repository/deployment/server/jaggeryapps/portal/configs/designer.json file, and configure the identityProviderUrl,acs and host attributes by replacing localhost with the IoT Server IP, or hostname and the respective profiles port.

    Code Block
    "identityProviderURL": "https://<IoT_SERVER_IP>:9443/samlsso",
"acs": "https://<IoT_SERVER_IP/HOSTNAME>:9445/portal/acs",
"host":{"hostname":"<IoT_SERVER_IP/HOSTNAME>","port":"","protocol":""},
    Info

    The default port of the WSO2 IoT Server profiles are as follows:

    WSO2 IoT Server core profile9443
    WSO2 IoT Server analytics profile9445
    WSO2 IoT Server broker profile9446

    Therefore, the analytics portal needs to be assigned the 9445 port.

  • Run the following commands so that the self-signed certificate refers to the IP you just configured instead of localhost.

    Info

    This step is required if your devices are accessing WSO2 IoT Server from outside the server.

    • Navigate to the <IOTS

    Open the <IoT_HOME>/

    core

    analytics/

    repository/resources/security directory and run the following commands to create the client-truststore.jks and wso2carbon.jks files with the new IP or hostname.
    Code Block
    keytool -delete -alias wso2carbon -keystore wso2carbon.jks
 
keytool -genkey -alias wso2carbon -keyalg RSA -keysize 2048 -keystore wso2carbon.jks -dname "CN=<IOT_SERVER_IP/HOSTNAME>,
OU=Home,O=Home,L=SL,S=WS,C=LK" -storepass wso2carbon -keypass wso2carbon

keytool -delete -alias wso2carbon -keystore client-truststore.jks

keytool -export -alias wso2carbon -keystore wso2carbon.jks -file wso2carbon.pem

keytool -import -alias wso2carbon -file wso2carbon.pem -keystore client-truststore.jks -storepass wso2carbon

    Copy the  client-truststore.jks  and  wso2carbon.jks  files that you just created to the following locations:

    Broker - <Iot

    bin/wso2server.sh file and replace localhost with the hostname. Example:

    Code Block
    -Dmqtt.broker.host="wso2" \
-Diot.keymanager.host="wso2" \
-Diot.gateway.host="wso2" \

  • Open the <IoT_HOME>/broker/repository

    /resources/security/Core - <Iot_HOME>/analytics/repository/resources/security/

    /conf/broker.xmlfile and replace localhost with the hostname. Example:

    Code Block
    <property name="hostURL">https://wso2:9443/services/OAuth2TokenValidationService</property>
<property name="tokenEndpoint">https://wso2:8243</property>
<property name="deviceMgtServerUrl">https://wso2:8243</property>

  • If you are using the hostname instead of the IP, open the <IOTS_HOME>/core/repository/deployment/server/jaggeryapps/devicemgt/app/conf/config.json file and configure the host property.


    Code Block
    "host" : "<ENTER_THE_HOSTNAME>"

  • Once you are done with the above steps, restart or start the message broker, IoT Server core, and the analytics profiles in the given order. For more information, see Starting the Server.