Certificates overview

Certificates used in Automation Suite, trust mechanisms, container architecture, and rotation processes on EKS/AKS.

This page describes all the certificates required by an Automation Suite installation as well as the principle of the certificate rotation process.

Important:

For details on the certificates you must provide when replacing the self-signed certificates, refer to Certificate requirements.

Understanding how trust certificates work

Inter-service communication between products inside Automation Suite is done via the FQDN of the cluster. Products cannot use internal URLs to communicate with each other. For example, Orchestrator can connect to Identity Server for user authentication via https://automationsuite.mycompany.com/identity.

While two different Automation Suite products must use the FQDN of the cluster, they can also contain multiple microservices. These microservices can use internal URLs to communicate with each other.

Understanding how communication works

The following diagram and flow explain how the client connects to a service and how the authentication is done via the Identity Service.

1. The client makes a connection with the service using URL, i.e., Orchestrator, Apps, Insights, etc. using the following URL: https://automationsuite.mycompany.com/myorg/mytenant/service_.

2. Istio intercepts the call, and based on the path of the service_, forwards the call to the specific service.

3. The service calls Identity Service to authenticate the incoming request from the client via https://automationsuite.mycompany.com/myorg/mytenant/identity_.

4. Istio intercepts the call, and based on the path identity_, forwards the request to Identity Service.

5. Identity Service returns the response with the result to Istio.

6. Istio returns the response to the service. Since the call is made using the HTTPS protocol, Istio returns the response with the TLS certificate so that the connection is secure. If the service trusts the server certificate returned by Istio, it approves the response. Otherwise, the service rejects the response.

7. The service prepares the response and sends it back to Istio.

8. Istio forwards the request back to the client. If the client machine trusts the certificate, then the entire request is successful. Otherwise the request fails.

   

Understanding how robots and Orchestrator communicate

This section describes a scenario where a robot tries to connect to Orchestrator in Automation Suite. The following diagram and flow explain how the robot connects to Orchestrator, and how authentication is done via Identity Server.

1. Robot makes a connection with Orchestrator using the following URL: https://automationsuite.mycompany.com/myorg/mytenant/orchestrator_

2. Istio intercepts the call, and based on the orchestrator_ path, it forwards it to the Orchestrator service.

3. The Orchestrator service calls Identity Server to authenticate the incoming request from the robot via https://automationsuite.mycompany.com/myorg/mytenant/identity_.

4. Istio intercepts the call, and based on the identity_ path, it forwards the request to Identity Server.

5. Identity Server returns the response with the results to Istio.

6. Istio returns the response to Orchestrator. Since the call is made using the HTTPS protocol, Istio returns the response with the TLS certificate, so that connection is secure. If Orchestrator trusts the server certificate returned by Istio, it also approves the response. Otherwise, Orchestrator rejects the response.

7. Orchestrator prepares the response and sends it back to Istio.

8. Istio forwards the request back to robot. If the robot machine trusts the certificate, then the entire request is successful. Otherwise, the request fails.

   

Understanding the container architecture related to certificates

Container level

The following diagram shows the container-level certificate architecture.

In this example, the container has its own operating system (RHEL OS), and Service can represent an Orchestrator running on top of RHEL OS.

Every OS has its own certificate store. In the case of RHEL OS, the Certificate Trust Store is located in /etc/pki/ca-trust/ca/.

This path is where RHEL OS stores all certificates. Every container will have its own Certificate Trust Store. As part of the Automation Suite configuration, we inject the entire chain certificate that contains the root certificate, all the intermediate certificates, as well as the leaf certificate, and we store them in this path.

Since services trust the root and intermediate certificates, they automatically trust any other certificates created by the root and intermediate certificates.

Pod level

There are hundreds of containers running within Automation Suite. Manually adding certificates for each of these containers for all the services would be a demanding task. However, Automation Suite includes a shared volume and an Init container cert-trustor to help with this task. Init is a specialized container that runs before app containers in a Pod, and its lifecycle ends as soon as it completes its job.

How the Cert-trustor container shares certificates

In the following example, the Orchestrator service is running in one pod. As a reminder, a pod can contain more than one container. In this pod, we inject one more Init container called Cert-trustor. This container will contain the root certificate, the intermediate certificates, and the leaf certificate.

The shared volume is attached to both Cert-trustor container and Orchestrator service container. It has the same path as the RHEL OS Certificate Trust Store: /etc/pki/ca-trust/ca/source/anchors.

Before Orchestrator can run, the Cert-trustor performs a job that will add the certificates in the shared volume in the /etc/pki/ca-trust/ca/source/anchors location and terminates. Certificates will be available for Orchestrator service through the shared volume.

The following diagram shows the pod-level certificate architecture.

Inventory of all certificates in Automation Suite

Certificates generated during installation

As part of the Automation Suite installation, the following certificates are generated:

• Self-signed certificate generated at the time of installation. We recommend that you replace the self-signed certificate with a domain certificate post-installation. Refer to Managing certificates.
  Note:

  The certificate can be generated at the time of installation only if you grant the Automation Suite installer admin privileges during the installation. If you cannot grant the installer admin privileges, then you must create and manage the certificate yourself.

• Identity Server certificate for signing JWT tokens used in authentication. If the certificate for signing the JWT token is not provided, Automation Suite uses the currently configured TLS certificate (self-signed or customer-provided). If you want to have your own certificate for signing identity tokens, refer to Managing certificates.

Additional certificates

• If enabled, SAML2 Authentication protocol can use a service certificate.
• If you configure Active Directory using a username and password, LDAPS (LDAP Over SSL) is optional. If you opt for LDAPS, you must provide a certificate. This certificate will be added into Automation Suite's Trusted Root Certification Authorities. For details, refer to Microsoft documentation.

Understanding how the certificate update/rotation works

The certificates are stored in two places:

• istio-ingressgateway-certs in <istio-system>
• <uipath> namespace

To update the certificate within <istio-system> and <uipath> namespaces, you must run the uipathctl config update-tls-certificates command.

Pods can only access secrets that are in their namespace. For instance, the pods running in the <uipath> namespace cannot access the secrets stored in the <istio-system> namespace. Hence, certificates are copied in both namespaces.

For the <uipath> namespace, we mount the certificates to the pods that need certificates and restart the pods so they can use the new certificates.

Note:

The update happens using the rolling deployment method. If microservices have two pods for high availability purpose, the update will delete one of the pods, and a new version of the pod will come up. Once the new one is started successfully, the old one will removed. There will be a brief downtime period while the old pod is not yet terminated.