Internet Security, Certificates, SSL

_

_

Introduction to Preparing Your Operational Environment

Before you configure your opentaps system with any of your business data, or your company's confidential information, or your company employee's data, it will be prudent to consider the security of your opentaps system servers and the related internet network security. Best practices with respect to this topic suggest the following partial list of salient points:

• Your server should be protected by a properly configured firewall to allow only the required forms of network access, as defined by your management and their technical system administrative staff.
• Any internet access to the opentaps server should probably be limited to SSL (secure socket layer) internet transmission layer security, as determined by your management and their technical system administrative staff. Consider both the public internet and any in-house local internets in this topic.
• You should secure all of the opentaps IDs that are active on the system, using a strong and unique password having properly limited distribution to users with a business need for them, and you should disable all other IDs on opentaps.
• You should make sure that your technical system administrator has secured all of the opentaps host server software components and related ports of every kind, so that no unintended routes of access are possible on your system.
• You should make sure that your opentaps server has physical security that is practiced 100% of the time, and that is robust enough to meet your management's requirements.
• Before you put any of your opentaps system functions into a production mode of operation, you should develop, test, and deploy your methods for system data backup and for system data restoration. You should actually practice the system data restoration periodically to make sure that it actually does work.
• Consider whether you will need a server for testing data restoration, migration, or new software component releases that is separate from the production servers that you use. (Usually, production servers are off limits for testing purposes.)
• Included in this preparation, you should include a determination of when backup will be collected, by whom, and where it will be stored so that if your operational facility is breached or destroyed there will still be a copy of your system backup data available, somewhere else.
• Make your own list adding all items to this topic which your company deems essential to your own best practices, and complete working your list. When making your own complete list, you may wish to consider what you would do if the internet access suffers an outage, either on the public internet or on your own local internets, or if the physical opentaps server computer suffers an outage.

If you do not need to attach your server to the internets while you are doing preliminary configuration, and preparing your environment then you may be able to phase some of the steps to make progress while other steps are still being completed.

Using SSL for opentaps Internet Security

opentaps can be configured to permit access only by the secure internet protocols, thus reducing the opportunity for unauthorized access to your system. This means having your users log-in and use your opentaps system via the secure internet https protocol (rather than non-encrypted http), and using the SSL-enabled ports (default on opentaps is port 8443) rather than the non-encrypted ports such as 80 or 8080.

Then there is the question of what to do about the SSL Certificate. The certificate is simply your internet identification "papers", including an encryption key that is uniquely yours, and these items are kept in a unique secure, encrypted file which acts as a lock box. This certificate (identity document) can be one that you have signed and issues by a public "certificate authority" recognized by the industry at large, or it can be a certificate that you create for yourself including your unique encryption key.

When opentaps is downloaded in the release package, and installed it contains a certificate for one of the organizations which produce the opentaps system releases, so that certificate is not yours, and it is not unique since many people will download the release code and install it. While you could operate with this default certificate for non-critical testing with no private information of any kind, you must install your own unique certificate for any other use of the system.

To Be Continued...

__

Introduction to Using SSL Certificates and Use Cases

The kind of Certificate you need depends upon how your opentaps system will be used, and by whom. Web browser software on the end user's computer will react differently to a self signed certificate which carries your unverified identity and your encryption key, as compared to a Certificate Authority signed certificate which has verified your identity, and also carries your encryption key. This verification of your identity is the significant item of difference.

You have the choice of using either a do-it-yourself, self-signed certificate or of purchasing a Certificate Authority verified and signed SSL certificate. The end user's web browser (such as Firefox or Internet Explorer) comes equiped with its on list of Certificate Authorities and will usually accept your certificate signed by one of them, without raising any warning messages to the user.

• Typically, a self-signed certificate will be used when your users of opentaps are internal to your organization and operate mostly on the same internal network. They will have been trained in how to manage the web browser warning and permission messages that are produced when self-signed certificates are being used. (Refer to your web browser documentation for guidance on handling such messages.)
• A certificate purchased from a Certificate Authority, such as GeoTrust, GoDaddy, VeriSign and others would be required for communications with users who are unable or unwilling to work with an unverified company identity that is using a self-signed certificate. Their issue with self-signed certificates is that the user cannot tell whether or not your internet site is legitimate unless they have personal knowledge of your company.
• Thus, if opentaps will be used for eCommerce with a secure checkout procedure, a Certificate Authority issued certificate is likely the best option. This will give the user the required confidence in your legitimacy and also an error-free/warning-free user experience.

In opentaps configuration, whether using a self-signed or Certificate Authority signed and issued certificate, the same certificate is used for securely connecting to all parts of the opentaps system. Whether you are working in the various modules of the system, or your customers are shopping on your opentaps eCommerce site, the single certificate is controlling access and security for your user networks.

Configuring Your opentaps Server with an SSL Certificate

There are several possible operational configurations for the opentaps server software, and the one you choose to implement will determine how the secure socket layer (SSL) Certificate will need to be installed.

We will begin by describing how to install your unique Certificate for opentaps simplest installation, which involves using the imbedded web server supplied in opentaps' pre-compiled, downloadable form for Linux.

Then, we will discuss some tips about how to handle the Certificates obtained in various formats from the authorities who sell "signed" and verified certificates. Finally, we will consider other possible opentaps installations and related Certificate issues.