Installing icom Router Management on Red Hat Enterprise Linux (RHEL)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5909721596463708658 (0x52038c7b1eac79f2)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=DE, L=Regensburg, O=INSYS MICROELECTRONICS GmbH, CN=iRM Install Guide Certificate Services
        Validity
            Not Before: May 24 12:40:00 2022 GMT
            Not After : May 24 12:40:00 2032 GMT
        Subject: C=DE, L=Regensburg, O=INSYS MICROELECTRONICS GmbH, CN=iRM Install Guide Certificate Services
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3573560371971845316 (0x3197d6398acb6cc4)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=DE, L=Regensburg, O=INSYS MICROELECTRONICS GmbH, CN=iRM Install Guide Certificate Services
        Validity
            Not Before: May 24 12:41:00 2022 GMT
            Not After : May 24 12:41:00 2024 GMT
        Subject: C=DE, L=Regensburg, O=INSYS MICROELECTRONICS GmbH, CN=irmop1.icomcloud.net
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Subject Alternative Name:
                DNS:irmop1.icomcloud.net, IP Address:164.90.225.14

sudo vi /etc/nginx/snippets/ssl-params.conf

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/nginx/dhparam.pem;
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
ssl_session_timeout  10m;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off; # Requires nginx >= 1.5.9
ssl_stapling on; # Requires nginx >= 1.3.7
ssl_stapling_verify on; # Requires nginx => 1.3.7
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
# Disable strict transport security for now. You can uncomment the following
# line if you understand the implications.
# add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";

openssl dhparam -out /etc/nginx/dhparam.pem 4096

sudo mkdir /etc/nginx/ssl
sudo cat irmop1.icomcloud.net.crt iRM_Install_Guide_Certificate_Services.crt > /etc/nginx/ssl/insysicom-routermgmt.crt
sudo cp irmop1.icomcloud.net.key /etc/nginx/ssl/insysicom-routermgmt.key
sudo chmod 600 /etc/nginx/ssl/insysicom-routermgmt.key

sudo vi /etc/nginx/snippets/insysicom-routermgmt-ssl.conf

ssl_certificate /etc/nginx/ssl/insysicom-routermgmt.crt;
ssl_certificate_key /etc/nginx/ssl/insysicom-routermgmt.key;

sudo vi /etc/nginx/sites-available/insysicom-routermgmt

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    include snippets/insysicom-routermgmt-ssl.conf;
    include snippets/ssl-params.conf;
    server_name _;

    client_max_body_size 300M;
    client_header_timeout 600;
    client_body_timeout 600;
    send_timeout 600;
    proxy_read_timeout 600;

    location = / {
        return 301 /ui;
    }
    location /ui/ {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass http://127.0.0.1:9203;
    }
    location /api/ {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass http://127.0.0.1:9203;
    }
    location /auth/ {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass http://127.0.0.1:9203;
    }
    location /graphql {
        proxy_read_timeout 180s;
        proxy_connect_timeout 180s;
        proxy_send_timeout 180s;
        send_timeout 180s;
        proxy_pass http://127.0.0.1:9203/graphql;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
    }
}

server {
    listen 8443 ssl;
    listen [::]:8443 ssl;
    include snippets/insysicom-routermgmt-ssl.conf;
    include snippets/ssl-params.conf;
    server_name _;

    location /devicecontrol {
        proxy_pass http://127.0.0.1:9202/devicecontrol;
        proxy_http_version 1.1;
        proxy_read_timeout 180s;
        proxy_connect_timeout 180s;
        proxy_send_timeout 180s;
        send_timeout 180s;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
    location /autoupdate/ {
        proxy_pass http://127.0.0.1:8082;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
   }
}

sudo nginx -t
sudo systemctl restart nginx
curl --cacert iRM_Install_Guide_Certificate_Services.crt https://164.90.225.14:8443/devicecontrol

sudo cp your_client_authentication-ca.crt /etc/nginx/ssl

sudo vi /etc/nginx/sites-available/insysicom-routermgmt

server {
    listen 8443 ssl;
    ...
    ssl_client_certificate /etc/nginx/ssl/your_client_authentication-ca.crt;
    ssl_verify_client on;
    ...
}

sudo nginx -t
sudo systemctl restart nginx

curl https://164.90.225.14:8443/devicecontrol

<html>
<head><title>400 No required SSL certificate was sent</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>No required SSL certificate was sent</center>
<hr><center>nginx/1.18.0</center>
</body>
</html>

curl --cert client.crt --key client.key --cacert iRM_Install_Guide_Certificate_Services.crt https://164.90.225.14:8443/devicecontrol

sudo vi /etc/nginx/sites-available/insysicom-routermgmt

server {
    listen 8443 ssl;
    ...
    location /devicecontrol {
        ...
        proxy_set_header X-Forwarded-Client-Cert $ssl_client_cert;
    }
    location /autoupdate/ {
        ...
        proxy_set_header X-Forwarded-Client-Cert $ssl_client_cert;
    }
}

sudo nginx -t
sudo systemctl restart nginx