Configuring the gateway
EC for Venafi uses TPP adaptable drivers, installed on each server in your cluster, to communicate with the gateway at various times in the life cycle of a TPP certificate. Each time the gateway receives a call from a driver, it verifies whether the driver is using the correct software version. If the versions do not match, certificate processing stops and an error message is sent indicating the problem. For more information about the TPP adaptable driver, see Installing-the-TPP-adaptable-driver-and-Bulk-Insert-utility and Configuring-the-TPP-adaptable-driver.
To set up your gateway, you must configure the following statements. You can find a sample configuration member, ECVGPARM, in the hlq.RSSSAMP library.
- Global statement
- HTTPServer statement
- TPPServer statement
- ECGateway statement
- TargetEnvironment statement
- LPARGroups statement
Global statement
The following global parameters define general functionality:
Parameter | Description |
|---|---|
ClassName FACILITY|className | By default, the RSS RACF resources are defined in the FACILITY class. If you placed the RSS resources in a different class during installation, specify it here. |
RACFAdminUser userID auto|noauto | Defines the user ID under which RACF commands are issued
If you omit RACFAdminUser, RACF commands run under the user ID for the address space on which RSS is running, with no APF authorization. |
CommandSecurity On|Off | Adds a layer of security, the userid must have READ access to RACF profile RSM.RSSCMD.command Whether RSS should implement an additional layer of security for MODIFY commands submitted to the started task When set to On, RSS checks for the RACF or Top Secret profile, RSM.RSSCMD.command, and verifies that the user submitting the MODIFY command has a minimum of READ access to the profile. If you omit this parameter, the default is Off. |
MessageLevel level level | Message level written to RSSPRINT You can define multiple message levels. We recommend that you include message level Info Error. |
TCPBufferSize | Specifies the size in bytes of the TCP receive buffer used by the EC for Venafi web interface The value of this parameter must be 65535. |
Activate appName | Name of the application to be loaded The value of this parameter must be Venafi. |
HTTPServer statement
Define the HTTP server to use to access the EC for Venafi web interface.
Parameter | Description |
|---|---|
HTTPServer | Begins the HTTPServer statement |
Protocol HTTP | (Required) Internet protocol used to access the web interface. Enter HTTP to access the web interface. |
Port portNumber | (Required) Port number of the web interface instance Enter the port number that the server uses for the web interface. |
EndHTTPServer | Ends the HTTPServer statement |
TPPServer statement
The following TPPServer parameters define the TPP server for the gateway instance. Only one TPPServer statement is required per instance.
Parameter | Description |
|---|---|
TPPServer | Begins the TPPServer statement |
HostName hostName | IPaddress | Location of the TPP REST server Enter the host name or IP address for the server on which the TPP REST interface is located. |
Port portNumber | Port number of the TPP REST server Enter the port number that the server on which the TPP REST interface is listening. |
ECGatewayURL url | URL of the EC for Venafi gateway Enter the URL of the EC for Venafi gateway exactly as it appears in the TPP device object. |
CertificateFolderName pathName | Path name to the TPP policy folder where new certificate objects will be created Enter the path name of the default TPP policy folder for new certificate objects created by using the EC for Venafi UI. For the specific syntax, see the example following this table. You can define multiple CertificateFolderName parameters. |
DeviceFolderName pathName | Path name to the TPP policy folder that contains the TPP device object Enter the path name of the TPP policy folder containing the device object that represents the EC for Venafi gateway. For the specific syntax, see the example following this table. |
DeviceObjectName objectName | Name of the TPP device object Enter the name of the TPP device object that represents the EC for Venafi gateway. |
Repository repositoryName | Location of the encrypted TPP API authentication token |
EndTPPServer | Ends the TPPServer statement |
ECGateway statement
The following ECGateway parameters define the REST API server for the gateway instance. Only one ECGateway statement is required per instance.
Parameter | Description |
|---|---|
ECGateway | Begins the ECGateway statement |
HostName hostName | IPaddress | (Required) Location of the gateway instance Enter the host name or IP address for the server on which the gateway is located. |
Port portNumber | (Required) Port number of the gateway instance Enter the port number that the server uses for the gateway. |
RequestTimeout seconds | hours | Number of seconds or hours after which agent requests from this gateway are abandoned Transactions that are not completed within this time period stop with a timeout error message. The default value is 120 seconds. |
TLSAware Yes | No | Verifies whether incoming transactions have been secured by a valid AT-TLS policy Transactions that are flagged as insecure or not having an AT-TLS policy are rejected. The default value is No. |
TPPHostName tppName | tppIPaddress | (Optional) Host name or IP address of the TPP client instance from which TPP transactions are expected to arrive Transactions arriving from other hosts are rejected. You can define multiple TPP client instances. |
Encoding ASCII | UTF8 | Encoding used for incoming requests from the REST API The default value is ASCII. |
GatewayId gatewayID | Name that the logging reports should use to identify the gateway from which a specific request is received |
EndECGateway | Ends the ECGateway statement |
TargetEnvironment statement
The following TargetEnvironment parameters define the environment (LPAR) in which an EC for Venafi agent is running. You can use multiple statement blocks to define multiple agent environments. You can also define Dynamic Virtual IP Addressing (DVIPA) environments if you are using DVIPA from TPP, instead of an LPAR, to process agent requests.
Parameter | Description |
|---|---|
TargetEnvironment envName | (Required) Name of the environment Enter the name of the environment in which the agent is located. The value specified for TargetEnvironment must match the value specified for the target environment in the definition of the TPP application that sends certificates to the agent. |
HostName hostName | IPaddress | (Required) Location of the agent instance Enter the host name or IP address for the server on which the the agent is located. |
Port portNumber | (Required) Port number of the agent instance Enter the port number that the server uses for the agent. |
EndTargetEnvironment | Ends the TargetEnvironment statement |
Sample Target Environment statements
LPARGroups statement
The following LPARGroups parameters define a group of LPARs under a single group name that you can use as a target environment in TPP. Requests sent to the group are sent to all LPARs specified for the particular group name.
Parameter | Description |
|---|---|
LPARGroups | Begins the LPARGroups statement |
grpname lpar1 lpar2 | (Required) Group name and the LPARs in that group Enter the name of the group and up to 15 LPARs, separated by spaces, to include in the group. You can add multiple groups to the statement. |
EndLPARGroups | Ends the LPARGroups statement |