- Overview
- Requirements
- Installation
- Post-installation
- Migration and upgrade
- Upgrading Automation Suite on EKS/AKS
- Migration options
- Step 1: Moving the Identity organization data from standalone to Automation Suite
- Step 2: Restoring the standalone product database
- Step 3: Backing up the platform database in Automation Suite
- Step 4: Merging organizations in Automation Suite
- Step 5: Updating the migrated product connection strings
- Step 6: Migrating standalone Insights
- Step 7: Deleting the default tenant
- B) Single tenant migration
- Monitoring and alerting
- Cluster administration
- Product-specific configuration
- Troubleshooting
Certificates overview
This page describes all the certificates required by an Automation Suite installation as well as the principle of the certificate rotation process.
https://automationsuite.mycompany.com/identity
.
While two different Automation Suite products must use the FQDN of the cluster, they can also contain multiple microservices. These microservices can use internal URLs to communicate with each other.
The following diagram and flow explain how the client connects to a service and how the authentication is done via the Identity Service.
- The client makes a connection with the service using URL, i.e., Orchestrator, Apps, Insights, etc. using the following URL:
https://automationsuite.mycompany.com/myorg/mytenant/service_
. - Istio intercepts the call, and based on the path of the
service_
, forwards the call to the specific service. - The service calls Identity Service to authenticate the incoming request from the robot via
https://automationsuite.mycompany.com/myorg/mytenant/identity_
. - Istio intercepts the call, and based on the path
identity_
, forwards the request to Identity Service. - Identity Service returns the response with the result to Istio.
- Istio returns the response to the service. Since the call is made using the HTTPS protocol, Istio returns the response with the TLS certificate so that the connection is secure. If the service trusts the server certificate returned by Istio, it approves the response. Otherwise, the service rejects the response.
- The service prepares the response and sends it back to Istio.
-
Istio forwards the request back to the client. If the client machine trusts the certificate, then the entire request is successful. Otherwise the request fails.
This section describes a scenario where a robot tries to connect to Orchestrator in Automation Suite. The following diagram and flow explain how the robot connects to Orchestrator, and how authentication is done via Identity Server.
- Robot makes a connection with Orchestrator using the following URL:
https://automationsuite.mycompany.com/myorg/mytenant/orchestrator_
- Istio intercepts the call, and based on the
orchestrator_
path, it forwards it to the Orchestrator service. - The Orchestrator service calls Identity Server to authenticate the incoming request from the robot via
https://automationsuite.mycompany.com/myorg/mytenant/identity_
. - Istio intercepts the call, and based on the
identity_
path, it forwards the request to Identity Server. - Identity Server returns the response with the results to Istio.
- Istio returns the response to Orchestrator. Since the call is made using the HTTPS protocol, Istio returns the response with the TLS certificate, so that connection is secure. If Orchestrator trusts the server certificate returned by Istio, it also approves the response. Otherwise, Orchestrator rejects the response.
- Orchestrator prepares the response and sends it back to Istio.
-
Istio forwards the request back to robot. If the robot machine trusts the certificate, then the entire request is successful. Otherwise, the request fails.
In this example, the container has its own operating system (RHEL OS), and Service can represent an Orchestrator running on top of RHEL OS.
/etc/pki/ca-trust/ca/
.
This path is where RHEL OS stores all certificates. Every container will have its own Certificate Trust Store. As part of the Automation Suite configuration, we inject the entire chain certificate that contains the root certificate, all the intermediate certificates, as well as the leaf certificate, and we store them in this path. Since services trust the root and intermediate certificates, they automatically trust any other certificates created by the root and intermediate certificates.
There are hundreds of containers running within Automation Suite. Manually adding certificates for each of these containers for all the services would be a demanding task. However, Automation Suite includes a shared volume and an Init container cert-trustor to help with this task. Init is a specialized container that runs before app containers in a Pod, and its lifecycle ends as soon as it completes its job.
In the following example, the Orchestrator service is running in one pod. As a reminder, a pod can contain more than one container. In this pod, we inject one more Init container called Cert-trustor. This container will contain the root certificate, the intermediate certificates, and the leaf certificate.
/etc/pki/ca-trust/ca/source/anchors
.
/etc/pki/ca-trust/ca/source/anchors
location and terminates.
Certificates will be available for Orchestrator service through the shared volume.
As part of the Automation Suite installation, the following certificates are generated:
-
Self-signed certificate generated at the time of installation. You are recommended to replace the self-signed certificate with a domain certificate post-installation. See Managing certificates.
- Identity Server certificate for signing JWT tokens used in authentication. If the certificate for signing the JWT token is not provided, Automation Suite uses the currently configured TLS certificate (self-signed or customer-provided). If you want to have your own certificate for signing identity tokens, see Managing certificates.
- If enabled, SAML2 Authentication protocol can use a service certificate.
- If you configure Active Directory using a username and password, LDAPS (LDAP Over SSL) is optional. If you opt for LDAPS, you must provide a certificate. This certificate will be added into Automation Suite’s Trusted Root Certification Authorities. For details, see Microsoft documentation.
This certificate will be added into Automation Suite’s Trusted Root Certification Authorities.
The certificates are stored in two places:
istio-ingressgateway-certs
inistio-system
uipath
namespace
istio-system
and uipath
namespaces, you must run the uipathctl config update-tls-certificates
command.
uipath
namespace cannot access the secrets stored in istio-system
namespace. Hence, certificates are copied in both namespaces.
uipath
namespace, we mount the certificates to the pods that need certificates and restart the pods so they can use the new certificates.
The update happens using the rolling deployment method. If microservices have two pod for high availability purpose, the update will delete one of the pod, and a new version of the pod will come up. Once the new one is started successfully, the old one will removed. There will be a brief downtime period while the old pod is not yet terminated.
- Understanding how trust certificates work
- Understanding how communication works
- Understanding how robots and Orchestrator communicate
- Understanding the container architecture related to certificates
- Container level
- Pod level
- Inventory of all certificates in Automation Suite
- Certificates generated during installation
- Additional certificates
- Understanding how the certificate update/rotation works