APM-Server is now using an SSL-Endpoint

Author: Chris Wiechmann

DEVELOPMENT.MD

@@ -80,6 +80,14 @@ instances:
       - "*.ec2.internal"
       - "*.compute-1.amazonaws.com"
       - "*.cloudapp.azure.com"
+  - name: "apm-server"
+    dns:
+      - "apm-server"
+      - "localhost"
+      - "api-env"
+      - "*.ec2.internal"
+      - "*.compute-1.amazonaws.com"
+      - "*.cloudapp.azure.com"
 ```
 
 Run elasticsearch-certutil:  

apibuilder4elastic/app.js

@@ -1,10 +1,12 @@
 const APIBuilder = require('@axway/api-builder-runtime');
 
 if(process.env.APM_ENABLED) {
-	console.log(`Application performance monitoring enabled. Using APM-Server: ${process.env.APM_SERVER || 'http://apm-server:8200'}`);
+	console.log(`Application performance monitoring enabled. Using APM-Server: ${process.env.APM_SERVER || 'https://apm-server:8200'}`);
 	require('elastic-apm-node').start({
 		serviceName: 'APIBuilder4Elastic',
-		serverUrl: process.env.APM_SERVER || 'http://apm-server:8200' 
+		serverUrl: process.env.APM_SERVER || 'https://apm-server:8200', 
+		verifyServerCert: ("false" == process.env.APM_VALIDATE_SERVER_CERT) ? false : true, 
+		serverCaCertFile: process.env.APM_SERVER_CA || 'config/certificates/ca.crt'
 	});
 }
 

apm/apm-server.yml

@@ -1,7 +1,12 @@
 apm-server:
-  host: "localhost:8200"
+  host: "apm-server:8200"
   rum:
     enabled: true
+  ssl:
+    enabled: true
+    certificate: "${APM_SERVER_CRT}"
+    key: "${APM_SERVER_KEY}"
+    key_passphrase: "${APM_SERVER_KEY_PASSPHRASE}"
 
 output:
   elasticsearch:

apm/docker-compose.apm-server.yml

@@ -13,6 +13,9 @@ services:
       - APM_USERNAME=${APM_USERNAME:-""}
       - APM_PASSWORD=${APM_PASSWORD:-""}
       - ELASTICSEARCH_CA=${ELASTICSEARCH_CA}
+      - APM_SERVER_KEY=${APM_SERVER_KEY}
+      - APM_SERVER_CRT=${APM_SERVER_CRT}
+      - APM_SERVER_KEY_PASSPHRASE=${APM_SERVER_KEY_PASSPHRASE:-""}
       - ELASTICSEARCH_ANONYMOUS_ENABLED=${ELASTICSEARCH_ANONYMOUS_ENABLED}
       - ELASTICSEARCH_CLUSTER_UUID=${ELASTICSEARCH_CLUSTER_UUID}
     ports:

config/certificates/README.md

@@ -1,7 +1,7 @@
 # Sample certificates for testing only
 
 The sample certificates in this folder will be automatically made available to the Docker-Containers by a mount and are pre-configured in the .env file.  
-:point_right:  It's stringly recommended that you use your own certificates and keys as the __certificates & keys are public on GitHub__. 
+:point_right:  It's strongly recommended that you use your own certificates and keys as the __certificates & keys are public on GitHub__. 
 
 Place you own certificates and keys in this directory and adjust the .env file accordingly. It's important that you are using different filenames, as the original files will be 
 replaced with the next version.

config/certificates/apm-server.crt

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDkjCCAnqgAwIBAgIUPIozXlFhTuj4e7B7sR6uWfCDdRYwDQYJKoZIhvcNAQEL
+BQAwNDEyMDAGA1UEAxMpRWxhc3RpYyBDZXJ0aWZpY2F0ZSBUb29sIEF1dG9nZW5l
+cmF0ZWQgQ0EwHhcNMjExMjA2MTUxNzA1WhcNMjQxMjA1MTUxNzA1WjAVMRMwEQYD
+VQQDEwphcG0tc2VydmVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+jZLBnI2d65STtMFlw3CUvleuw8VoJf5JtqwgQ5o49O/sHH84J3YxzsFJsnQAmQWD
+mmT8IstFNSqn+mPzw8krwAjZnJGo3chlhRPiW7Xm58ngpnTbC9H8eEGWRgPgkI3p
+9gUKlM2LgBAM/wmJ/XSz9tYzyOmOPVkBrD+y8JFXeLvTNlu6/XG/fswlTahDo+M4
+AA4cwWFSpNtc4dbwqgbO7AZMKJPyJPExkMCnTJ0ZDW6L/ZBnZlBT4G1wfN+D75AP
+0vtV+/2i4dfTVxqILAdvL6u0aJ7Zr8GE9GOGaC6SvL1JEVKYkQnY8znZi3+oDokK
+R96Y1DMFf6sUfPQkl+7u2wIDAQABo4G6MIG3MB0GA1UdDgQWBBTiz+JktSXcH4qO
+JveRIUnDpOq2ozAfBgNVHSMEGDAWgBTzt0vFY8RrVFAhz65+u0JCekAs1jBqBgNV
+HREEYzBhghQqLmNsb3VkYXBwLmF6dXJlLmNvbYIJbG9jYWxob3N0ggdhcGktZW52
+ggphcG0tc2VydmVygg4qLmVjMi5pbnRlcm5hbIIZKi5jb21wdXRlLTEuYW1hem9u
+YXdzLmNvbTAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQBRx5U7XmDiap/+
+3MOUIVqqJ9Z28KReC7jlSzMjMdHTqzUEEkhP7reRktGw3XgRg8lTHQ2MdEpf4DVg
+h2xUka4PlWhvUZJL20lwiWbs+RnozN878yD2fVm/gbcM9jIAORZznPoiyKxptpcw
+0JHAvKIvksJm0i0FllfNwNdzngn8H8xJe3cjMhqSKjldS5JFuDZaiTj+bra1Vlz2
+pvhaE3g4te9HJgSzEQHPzezXJToRlNvsgPF3i303NZfQz+QSOOOIJX6xIN+QwtJj
+g9EhR6ic0eM7Ph9a9EM6Xw6nx0LWoYXzxwEotA2vXR1CLdsO7YVs4TNUfDcXf7eo
+QlWF4kBc
+-----END CERTIFICATE-----

config/certificates/apm-server.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAjZLBnI2d65STtMFlw3CUvleuw8VoJf5JtqwgQ5o49O/sHH84
+J3YxzsFJsnQAmQWDmmT8IstFNSqn+mPzw8krwAjZnJGo3chlhRPiW7Xm58ngpnTb
+C9H8eEGWRgPgkI3p9gUKlM2LgBAM/wmJ/XSz9tYzyOmOPVkBrD+y8JFXeLvTNlu6
+/XG/fswlTahDo+M4AA4cwWFSpNtc4dbwqgbO7AZMKJPyJPExkMCnTJ0ZDW6L/ZBn
+ZlBT4G1wfN+D75AP0vtV+/2i4dfTVxqILAdvL6u0aJ7Zr8GE9GOGaC6SvL1JEVKY
+kQnY8znZi3+oDokKR96Y1DMFf6sUfPQkl+7u2wIDAQABAoIBAAvB7zgHP63iLjPK
+BzkoaNIEcJk44Qg2vclHMxUqNVmL2DoaceY+sXt2uTe+3PkLm8n/LqMQUQ3nUWgN
+up+9KosAsShVpVNpLzU48rwKUV2/efUyqamqDAoYuFg8PjKcw2kRMuqRkrWIbIV9
+AoUwMG039B9wqV8WI0ag5UWH0vhN0V9NVO0ejh8WurTaNL3PoZ7GUIpm3g83FUc9
+k5Fb8iknR8UpQKXlj2A+u3+WNIYDZ+OFh5JOZ1Ld6gvzWYdbUBSMTSTi6rN9nRPm
+npnClcKlFYswoOrtre43b8uhDr12FL/L2WeleqhAkaLbpPP8Erd+psYfO4uzRwRy
+EF6PvmECgYEAyAuCb4SUal3TIi1zpVXPpHmWqDW1UQdzZt+RNSKj+M3PacT/1BBb
+piXPMmw8Lp8VI8TXo02n68Tsze89TUDfHLtKqZsr1SWMmsanQBVihKm8V9UJHe/r
+zTy2TWROd6+A9uwsWAWN+Vr7NMt/KsG3uYamkJ69nrIGRj0W/S2lcwMCgYEAtSxN
+Tx6ewXnFjBKZDAbKxk21VB1M0v2CimDieGUJOtVRdmVC6DgANzdU6ym1x6JML4K5
+ou9rR3F632KAyX3BIxytOeCxw6akop828Nl/+C492BhnDRo54TnJDD6XR1pL0Edm
+bRUHKCdN0BFPwtWtf58eykGOO5AVcrIM+mIPYUkCgYEAlKLwpNm2yR2zvgZVkjij
+UwtA5PUbJvzJQ1vEcd2uRjTt8yH8EF6jKl2XiVigkueC9pPQwbb2mRk19oHXY6pa
+3OdQv5rbQ8Flqq8GIHiDPh08I2rYHlVhOJruvaxVHVrbER1EiZZ++hMe6gh2EZfk
+YkZpRrWcIOkX/mJvzWh4MW8CgYAk+tr42FYtRa7F7ZHhu40uNvRZK/XfZzF7D1WK
+n4znvlz3XqnufmfE3X1u1r+s9Pq6A+PiVx49ofMjn5aMCigfA550HuIJ/nzCWN89
+ABg3zzB+aFS4fu7rgwD/h9MXFF4/MCO/BjjEwGkInE/8g+L7Fr6RKBphHALUu3Uc
+smFTSQKBgHPLFqLzbqfHOzv6iWP4koONTf3zVMrOoSMYtvBPDPbn3sm3oi3oPvm+
+uJSrbGUoNiXet6d4+xHgMlMDP7tjAyBlLCc5Fx07612ZSILPLuOsANSwgVY+YPNT
+HDY/li9CGvxq92bOcENZnXhKH24XClmL6pABLRDp1+CDzPWGqIlt
+-----END RSA PRIVATE KEY-----

docker-compose.yml

@@ -82,6 +82,7 @@ services:
       - LOG_LEVEL=${API_BUILDER_LOG_LEVEL}
       - APM_ENABLED=${APM_ENABLED}
       - APM_SERVER=${APM_SERVER}
+      - APM_SERVER_CA=${APM_SERVER_CA}
     ports:
       - 8443:8443
     networks:

env-sample

@@ -507,9 +507,20 @@ ELASTIC_VERSION=7.15.2
 
 # ----------------------------------------------------------------------------------------------
 # This is used by the API-Builder process for the APM-Server connection. It defaults to 
-# http://apm-server:8200 if not configured, which is the service-name when using docker-compose. 
+# https://apm-server:8200 if not configured, which is the service-name when using docker-compose. 
 # Used-By: API-Builder4Elastic
-# APM_SERVER=http://my-apm-server:8200
+# APM_SERVER=https://my-apm-server:8200
+
+# ----------------------------------------------------------------------------------------------
+# Parameter used by API-Builder if the APM-Server certificate should be validated.
+# Used-By: API-Builder4Elastic
+# APM_VALIDATE_SERVER_CERT=false
+
+# ----------------------------------------------------------------------------------------------
+# Certificate authory used by API-Builder4Elastic to validate the server certificate.
+# Used-By: API-Builder4Elastic
+# Defaults to the CA used by all components.
+# APM_SERVER_CA=config/certificates/ca.crt
 
 # ----------------------------------------------------------------------------------------------
 # Account used by the APM-Server for the Elasticsearch communication. For the initial setup it 
@@ -557,3 +568,7 @@ ELASTICSEARCH_CRT=config/certificates/elasticsearch1.crt
 KIBANA_KEY=config/certificates/kibana.key
 KIBANA_CRT=config/certificates/kibana.crt
 KIBANA_KEYPASSPHRASE=
+
+APM_SERVER_KEY=config/certificates/apm-server.key
+APM_SERVER_CRT=config/certificates/apm-server.crt
+APM_SERVER_KEY_PASSPHRASE=