Configure Server for Mutual Authentication

Configure the Seeker server to enable mutual authentication with the Agents.

Make sure that your Seeker server certificate is signed by your organization's root Certificate Authority (CA), and that the root Certificate Authority (CA) is trusted by both server and Agent machines.

CAUTION:

Currently, this is supported for the Java, .NET Core, .NET Framework, and Node.js Agents only. If you have other technologies in your environment, enabling mutual authentication will block other Agents.

  1. Open the SEEKER_HOME_DIR/server/conf/nginx.conf file for editing.
  2. Comment the # handle routing without mutual authentication section: 
    # handle routing without mutual authentication
# location / {
#     # if user agent header is a known seeker agent (Seeker <TECH> Agent) route to sensor
#     if ($http_user_agent ~ "Seeker.*Agent") {
#         proxy_pass  http://seeker_sensor;
#     }
#     # else, route to server
#     proxy_pass http://seeker_server;
# }
  3. Uncomment the # handle routing with mutual authentication section: 
    # handle routing with mutual authentication
# client certificate
ssl_client_certificate /path/to/ca.crt;
# make verification optional, so we can display a 403 message to those
# who fail authentication
ssl_verify_client optional;
location / {
    set $tmp 0;
    # if user agent header is a known seeker agent (Seeker <TECH> Agent) enable 1 bit
    if ($http_user_agent ~ "Seeker.*Agent") {
        set $tmp 1;
    }
    # if ssl verification passed enable another bit
    if ($ssl_client_verify = SUCCESS) {
        set $tmp "${tmp}1";
    }
    # if this is an agent request and SSL is ok, route to sensor
    if ($tmp = 11) {
        proxy_pass  http://seeker_sensor;
    }
    # if this is an agent request and SSL failed, return 403
    if ($tmp = 1) {
        return 403;
    }
 
    # else, route to server
    proxy_pass http://seeker_server;
}
  4. In the ssl_client_certificate /path/to/ca.crt; line, change the path to point to your own certificate.