Skip to content

Secure the SEAL Operator Services

For security reasons, SEAL Systems strongly recommends using TLS encryption. This also helps to avoid certificate warnings in the browser.

Configure the TLS Encryption

  1. Get a TLS certificate in PEM format, as written in the Requirements.

  2. Replace the following file containing the private key:

    /opt/seal/etc/tls/key.pem

  3. Replace the following file containing the public certificate:

    /opt/seal/etc/tls/cert.pem

  4. Set the paths for the directories containing the certificate files.

    • TLS_DIR: directory containing the certificate files necessary for the secure transfer within SEAL Operator

    • TLS_EXTERNAL_DIR: directory containing the external certificate files necessary for the services handling external requests

    env:
  service:
    any:
      tag:
        any:
          TLS_DIR: '/opt/seal/etc/tls'
          TLS_EXTERNAL_DIR: '/opt/seal/etc/external_tls'

    Hint - no trailing slash

    Make sure the path does not end with a slash.

    Hint - TLS certificate fallback chain

    TLS_EXTERNAL_DIR -> TLS_DIR -> built-in certificates

    Hint - system certificate store not trusted by Node.js

    Importing a CA certificate into the system certificate store does not make it trusted by the seal-operator-* services. These services run on Node.js and do not use the system certificate store. For the services to trust the certificate, provide it via TLS_EXTERNAL_DIR or TLS_DIR instead.

    Caution - unverified observation

    In one observed case, setting TLS_EXTERNAL_DIR without also setting NODE_TLS_REJECT_UNAUTHORIZED to 0 caused a crash loop across most seal-operator-* services. This has not been confirmed by log analysis. If services fail to start after setting TLS_EXTERNAL_DIR, also try setting NODE_TLS_REJECT_UNAUTHORIZED to 0.

  5. If self-signed certificates are used, NODE_TLS_REJECT_UNAUTHORIZED has to be set to 0:

    env:
  service:
    any:
      tag:
        any:
          NODE_TLS_REJECT_UNAUTHORIZED: '0'

    Caution - security gap

    Setting NODE_TLS_REJECT_UNAUTHORIZED to 0 in a productive system is a serious security gap! Only use it for test purposes!

    Hint - certificate

    Unless NODE_TLS_REJECT_UNAUTHORIZED is set to 0, the certificate has to contain the correct IP address or host name since this is used for the authorization check.

  6. Restart SEAL Operator.

    operator service start

Specify a CA Certificate

In most cases, you do not need to specify a CA certificate. A CA certificate does not make the SEAL Operator services require client certificates. The services do not request a client certificate from other services or from the web browser.

seal-operator-server uses the CA certificate to verify the certificates of the target systems it connects to.

To specify a CA certificate, save it to the following file:

/opt/seal/etc/tls/ca.pem

Next Step

Continue with: Secure Consul

Back to top