Skip to content

Commit 497472c

Browse files
Y0CossY0Coss
authored
Merge pull request #7824 from ovh/YC-SK2112-SSL-Gateway-duplication
How to use SSL Gateway - Creating missing EN/ES duplicates
2 parents f514240 + cb90c57 commit 497472c

File tree

9 files changed

+1824
-17
lines changed

9 files changed

+1824
-17
lines changed

‎pages/web_cloud/ssl_gateway/use_ssl_gateway/guide.en-asia.md

Lines changed: 255 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,255 @@
1+
---
2+
title: Using the SSL Gateway
3+
excerpt: Secure connections to your website
4+
updated: 2022-12-01
5+
---
6+
7+
## Overview
8+
9+
### Requirements
10+
11+
- Order placed for the SSL Gateway service.
12+
- Access to the Sunrise Control Panel.
13+
14+
## Use
15+
16+
We will now explain how to use your SSL Gateway service
17+
18+
### Configuring the service
19+
20+
Log in to [your control panel](/links/manager){.external}.
21+
Then click on the `Sunrise`{.action} section.
22+
23+
![sunrise button](images/4.PNG){.thumbnail}
24+
25+
Then click on `SSL Gateway`{.action} to view the service.
26+
27+
![ssl gateway button](images/5.PNG){.thumbnail}
28+
29+
Select the solution that you wish to configure.
30+
31+
![commercial page](images/6.PNG){.thumbnail}
32+
33+
You will then land on the page for managing your solution.
34+
35+
![overall config](images/7.PNG){.thumbnail}
36+
37+
|Option|Description|
38+
|---|---|
39+
|IPv4|IPv4 address of the OVHcloud gateway you would like to point to|
40+
|IPv6|IPv6 address of the OVHcloud gateway you would like to point to|
41+
|Zone|Geographic zone of your SSL Gateway IP address|
42+
|Outgoing IPv4|OVHcloud IPv4 addresses that will connect to your server|
43+
|Solution|Solution subscription type|
44+
|Documentation|Link to this user guide|
45+
|Status|Your SSL Gateway service status|
46+
|Expiry date|Expiry date for your SSL Gateway service|
47+
|Cancel|Cancellation request button for your SSL Gateway service|
48+
|Upgrade to Advanced solution|Allows you to upgrade from the Free solution to the Advanced solution|
49+
|Configuration|Button that allows you to edit the configuration of your SSL Gateway service|
50+
|HSTS [[1]](#id5){.note-ref #id1}|Requires the browser to make all future connections to your website in HTTPS|
51+
|Reverse|Allows you to put a host name on your SSL Gateway IP address|
52+
|HTTPS Redirection [[2]](#id6){.note-ref #id2}|Redirects the visitor to the HTTPS version of your site when they access it in HTTP|
53+
|HTTPS Server [[3]](#id7){.note-ref #id3}|Enables HTTPS between the SSL Gateway server and your server|
54+
|Source IP restriction|If this field is filled in, only the IPs or networks listed can connect to the SSL Gateway|
55+
|Cipher configuration [[4]](#id8){.note-ref #id4}|Allows you to choose a security level for your SSL/TLS certificate|
56+
57+
> [!primary]
58+
>
59+
> [[1]](#){.note-ref #id5} - ([1](#id1){.fn-backref})
60+
> <cite>More information on HSTS.</cite>
61+
>
62+
> [[2]](#){.note-ref #id6} - ([1](#id2){.fn-backref})
63+
> <cite>Once you have checked that your site is running smoothly with HTTPS protocol, you can redirect all HTTP traffic to HTTPS. We would still recommend that you wait 24 hours after pointing your domain to the SSL Gateway solution before redirecting the traffic, so that visitors to your website definitely have the new functional DNS configuration.</cite>
64+
>
65+
> [[3]](#){.note-ref #id7} - ([1](#id3){.fn-backref})
66+
> <cite>Allows the connection to be secured end to end. The SSL Gateway server will connect to your server on the standard HTTPS 443 port. Please note that your server needs to be SSL/TLS certified in order to enable this option. Without this, your website will not function. However, you do not need to renew this certification for your server.</cite>
67+
>
68+
> [[4]](#){.note-ref #id8} - ([1](#id4){.fn-backref})
69+
> <cite>The highest level will offer the best protection, but it may not work on older browsers.</cite>
70+
>
71+
72+
[For more information on cipher](https://en.wikipedia.org/wiki/Cipher){.external}.
73+
74+
### Configuring the domain
75+
76+
The following block includes 4 tabs:
77+
78+
- **Domains**
79+
- **Servers**
80+
- **Tasks**
81+
- **Graphs**
82+
83+
![Domains tab](images/10.PNG){.thumbnail}
84+
85+
The **"Domains"** tab allows you to add and delete your domains and subdomains connected to your SSL Gateway.
86+
87+
Click `+ Domain`{.action} to add a domain or subdomain.
88+
89+
If you are using a **"Free"** solution you will only be able to have one **domain**, as well as its **“www” subdomain** and a second **subdomain of your choice**:
90+
91+
|Name|URL|
92+
|---|---|
93+
|Domain|example.com|
94+
|Subdomain|www.example.com|
95+
|Subdomain of your choice|blog.example.com|
96+
97+
> [!warning]
98+
>
99+
> - Free solution: only third level domains (www.example.org) are authorised.
100+
>
101+
102+
Select your choice, then click `Add`{.action} to validate.
103+
104+
![add free domain](images/11.PNG){.thumbnail}
105+
106+
If you are using an **"Advanced"** solution you will be able to add any active domain or subdomain.
107+
108+
> [!primary]
109+
>
110+
> - Advanced solution: fourth level domains (blog.uk.example.org) and higher are authorised.
111+
>
112+
113+
Select your choice, then click `Add`{.action} to validate.
114+
115+
![add advanced domain](images/12.PNG){.thumbnail}
116+
117+
> [!warning]
118+
>
119+
> Whenever a domain or subdomain is added, you will receive an email prompting you to point it to the SSL Gateway IP within 3 days.
120+
> This operation is required in order to validate the creation of the SSL/TLS certificate.
121+
>
122+
123+
The **"Servers"** tab allows you to manage the IP address(es) of the server(s) hosting your website.
124+
125+
Click `+ Server`{.action} to add an IP address and a port corresponding to your server hosting your website.
126+
127+
![servers tab](images/13.PNG){.thumbnail}
128+
129+
- If you are using a **"Free"** solution: you will only be able to use one IP/PORT address.
130+
131+
- If you are using an **"Advanced"** solution: you will be able to add up to 3 IP/PORT addresses for your domains and subdomains.
132+
133+
> [!primary]
134+
>
135+
> If you list several IP/PORT addresses, your SSL Gateway will distribute the traffic load with the Round Robin DNS system.
136+
>
137+
138+
Select your choice, then click `Add`{.action} to validate.
139+
140+
![add advanced IP/PORT (internal)](images/15.PNG){.thumbnail}
141+
142+
> [!warning]
143+
>
144+
> Currently, it is not possible to add IPv6 addresses into your servers.
145+
> However, this is not an issue, since your domain or subdomain can point to your SSL Gateway in IPv6.
146+
> Your SSL Gateway will then seamlessly switch the IPv6 traffic over to your server’s IPv4 address.
147+
>
148+
149+
The **"Tasks"** tab allows you to view the operations in progress on your SSL Gateway.
150+
151+
![tasks tab](images/13-bis.PNG){.thumbnail}
152+
153+
> [!warning]
154+
>
155+
> If we have not yet detected your domain pointing to the SSL Gateway IP, then the SSL/TLS certificate will not yet have been created.
156+
> However, your website will still be accessible in "HTTP". In this case, a small "HTTP" thumbnail image will appear in the "Entering" tab.
157+
>
158+
> ![http only](images/14.PNG){.thumbnail}
159+
>
160+
161+
The **"Graphs"** tab allows you to view the number of connections and requests made per minute to your SSL Gateway.
162+
163+
![metrics tab](images/17.PNG){.thumbnail}
164+
165+
- If you are using a **"Free"** solution: you will be able to view your metrics over a 24 hour period.
166+
167+
- If you are using an **"Advanced"** solution: you will be able to view your metrics over a 1 month period.
168+
169+
## Renewing your SSL certificate
170+
171+
### Important note
172+
173+
In order to renew the Let’s Encrypt certificate, the domain or subdomain will need to point to the SSL Gateway solution’s IP.
174+
175+
- If this is not the case, and our robots detect this 7 days before the SSL/TLS certificate renewal date, an email will be sent, giving you 3 days to carry out this operation.
176+
177+
- If this operation has not been carried out after 3 days, the certificate will not be renewed. You will need to regenerate it manually using this button:
178+
179+
![Regenerate SSL](images/16.PNG){.thumbnail}
180+
181+
## Tips
182+
183+
### Correcting the source IP in logs
184+
185+
#### Presentation
186+
187+
When a customer visits your website, they will connect to the SSL Gateway in HTTPS, then the SSL Gateway tracks the request to your server after decoding it and filtering attacks. All requests to your server come from the SSL Gateway.
188+
189+
In order to track your visitor’s IP address, the SSL Gateway automatically adds these standard HTTP headers:
190+
191+
- X-Forwarded-For and X-Remote-Ip: Customer’s IP address, as viewed by the SSL Gateway.
192+
- X-Forwarded-Port and X-Remote-Port: Customer’s source port, as viewed by the SSL Gateway.
193+
194+
Since these fields can be forged by a malicious customer, they must not be taken into account unless they come from a trusted source such as an SSL Gateway. The list of source IPs used by the SSL Gateway can be found in:
195+
196+
- Your Sunrise Control Panel
197+
- The SSL Gateway section
198+
- The “Outgoing IPv4” field
199+
200+
On the date of this guide being written, these addresses are **213.32.4.0/24** and **144.217.9.0/24**. Other addresses can be added in the future.
201+
202+
If your server manages it, it can be configured to recognise this information automatically instead of the SSL Gateway IP.
203+
204+
#### Apache
205+
206+
Create the file below:
207+
208+
`/etc/apache2/conf-available/remoteip.conf`
209+
210+
Insert the following lines:
211+
212+
```bash
213+
# Trust X-Forwarded-For headers from the SSL Gateway
214+
# See https://www.ovh.com/manager/sunrise/sslGateway/index.html#/sslGateway for an up-to-date list
215+
RemoteIPHeader X-Forwarded-For
216+
RemoteIPInternalProxy 213.32.4.0/24
217+
```
218+
219+
You can now replace the variables %h with %a in the LogFormat directives of the Apache configuration.
220+
221+
Once the configuration is ready, you will just need to enable it with the following commands:
222+
223+
```bash
224+
# Enable the module then the configuration
225+
a2enmod remoteip
226+
a2enconf remoteip
227+
228+
# Restart Apache to recognise the module (reload is sufficient for configuration)
229+
service apache2 restart
230+
```
231+
232+
You can find more information regarding this Apache feature in the [official documentation](https://httpd.apache.org/docs/current/en/mod/mod_remoteip.html){.external}.
233+
234+
#### Nginx
235+
236+
Open the configuration file that corresponds to the website to be secured. It is usually located in: `/etc/nginx/sites-enabled`
237+
238+
Insert the following lines into the server section:
239+
240+
```bash
241+
# Trust X-Forwarded-For headers from the SSL Gateway
242+
# See https://www.ovh.com/manager/sunrise/sslGateway/index.html#/sslGateway for an up-to-date list
243+
set_real_ip_from 213.32.4.0/24;
244+
real_ip_header X-Forwarded-For;
245+
```
246+
247+
You can find more information regarding this Nginx function in the [official documentation](http://nginx.org/en/docs/http/ngx_http_realip_module.html){.external}.
248+
249+
## Go further
250+
251+
For specialised services (SEO, development, etc.), contact [OVHcloud partners](/links/partner).
252+
253+
If you would like assistance using and configuring your OVHcloud solutions, please refer to our [support offers](/links/support).
254+
255+
Join our [community of users](/links/community).

0 commit comments

Comments
 (0)