Set up a production environment

Set up the certificates

Version: 10.5

Sitecore Experience Platform is designed to be secure by default. You must therefore implement HTTPS across the platform.

Server Certificate Authentication

All communication between Sitecore instances occurs over the default HTTPS configuration. This includes the xConnect web services, the Sitecore Identity server, and the Solr search provider. HTTPS requires that you obtain and set up certificates for the Secure Sockets Layer (SSL) before you install the platform.

Server authentication uses a server-side certificate and a private key to encrypt traffic between the HTTP client and the HTTP server application. This type of authentication prevents unencrypted content from traveling over an unsecured network. It does not identify who the client is and the server authentication alone does not determine who can connect to the server.

Client Certificate Authentication

The xConnect server roles support an additional layer of security, referred to as SSL Client Certificate Authentication. SSL Client Certificate Authentication validates that the individual HTTP client is authorized to connect to the HTTP server. SSL Client Certificate Authentication requires that the HTTP client device is configured with a specific client certificate and private key, or thumbprint, which is used to connect to the protected SSL server.

Because xConnect web services use server-to-server communication and are non-interactive, the client certificate allows the Content Management server role and other server roles to connect securely to WebAPI JSON services.

Important

In local developer environments, self-signed certificates can be used to develop Sitecore solutions. Due to potential security concerns, you must not use self-signed certificates in production environments.

Set up server certificate SSL authentication on IIS

You must obtain and install the server certificates before you run SIF. For more information about how to set up SSL in IIS, see Microsoft’s documentation.

The following table lists the full set of server authentication certificates for this topology:

		XP Scaled (XP1)
		Content Management Content Delivery Processing Sitecore Cortex™ Processing Service Sitecore Cortex™ Reporting Service Sitecore Identity server xConnect Collection xConnect Collection Search xDB Reference Data xDB Automation Operations xDB Automation Reporting

For each certificate, you must use the site name in the common name CN field in the certificate. For example, if the name that you want to use for the Content Management IIS site is CM_test, you must use this name when you create the Content Management certificate.

Note

Starting with Sitecore 10.0.1, the Content Delivery server role comes with the HTTPS protocol enabled by default.

If you need to deploy a CD server role that uses the HTTP protocol, you can change the protocol. To use the HTTP protocol, before you deploy the CD server role, in the sitecore-XP1-cd.json file, set the DisableHttpsForCD parameter to true.

Install the server certificates

After you obtain the relevant certificates, you must install them.

To install the server certificates:

Install the server authentication certificate in the system certificate store folder:
Certificates (Local Computer)\Personal
For information about how to install a private key certificates, see PowerShell Import-Certificate from Microsoft.
If you created a self-signed certificate, install the self-signed authority certificate for the SSL certificate in the following folder:
Certificates (Local Computer)\Trusted Root Certification Authorities

For XP Scaled (XP1), after you obtain all the server certificates, you must install them on the required servers:

XP Scaled (XP1)

Role Name	Server Certificate
Content Management	Sitecore Identity server Processing xConnect Collection Search xDB Reference Data xDB Automation Operations xDB Automation Reporting Sitecore Cortex™ Reporting Service Sitecore Cortex™ Processing Service
Content Delivery	Content Management xConnect Collection xDB Reference Data xDB Automation Operations
Processing	xConnect Collection
xConnect Collection	None required
xConnect Collection Search	None required
xDB Reference Data	None required
xDB Automation Operations	xConnect Collection xDB Reference Data
xDB Automation Reporting	None required
EXM Dedicated Dispatch Server	Sitecore Identity server Processing xConnect Collection xConnect Collection Search xDB Reference Data xDB Automation Operations xDB Automation Reporting
Sitecore Cortex™ Reporting service	None required
Sitecore Cortex™ Processing Service	xConnect Collection xConnect Collection Search

Setting up the client certificates

You must obtain and install the client certificates for a production environment before running SIF. If you do not provide the certificates, SIF creates self-signed certificates when they are required.

The client certificate is typically installed on the Windows Server that connects to the server where xConnect is deployed. The client certificate is stored in the certificate store for either a specific user or the entire server.

The thumbprint of the client certificate is specified on the server that you are connecting to (the destination). In this case, the xConnect server and only clients with the correct certificate and matching thumbprint are allowed to connect.

In production environments, different client certificates are used for different application roles with the aim of isolating the servers, in the event of a key being compromised.

For development purposes, you can use a single client certificate to validate that authentication will work as expected when you move to a production environment.

The following table lists the full set of client authentication certificates for this topology:

XP Scaled (XP1)
xConnect Collection xConnect Collection Search xDB Reference Data xDB Automation Operations Sitecore Cortex™ Processing Service Sitecore Cortex™ Reporting service

Install the client certificate

After you have obtained the certificates, you must install them.

To install the client certificate:

Install the client authentication certificate, including the private key, in the Certificates (Local Computer)\Personal folder for each required role.

For information about how to install a private key certificates, see PowerShell Import-Certificate from Microsoft.

Important
When you import the client certificate, you must select the Allow private key to be exported option.
If you created a self-signed certificate, you must install the self-signed authority certificate used to create the client authentication certificate in the Certificates (Local Computer)\Trusted Root Certification Authorities folder.
You must add the thumbprint for the certificates that you installed in the previous step to the following roles:
- xConnect Collection
- xConnect Collection Search
- xDB Reference Data
- xDB Automation Operations
- xDB Automation Reporting
- Sitecore Cortex™ Processing Service
In the /App_Config/AppSettings.config file, add the thumbprint to the <add key="validateCertificateThumbprint" value="YOUR_CERTIFICATE_THUMBPRINT" /> setting.

This defines which client certificate is used for authentication.

The following tables provide details about the client certificates required for each role:

XP Scaled (XP1)

Role name	Client Certificates	Associated connection strings containing client thumbprint
Content Management	xConnect Collection Search xDB Reference Data xDB Automation Operations xDB Automation Reporting Sitecore Cortex Reporting Service	`xconnect.collection.certificate` `xdb.referencedata.client.certificate` `xdb.marketingautomation.reporting.client.certificate` `xdb.marketingautomation.operations.client.certificate` `sitecore.reporting.client.certificate` `cortex.processing.engine.client.certificate`
Content Delivery	xConnect Collection xDB Reference Data xDB Automation Operations	`xconnect.collection.certificate` `xdb.referencedata.client.certificate` `xdb.marketingautomation.operations.client.certificate`
Processing	xConnect Collection	`xconnect.collection.certificate`
Sitecore Cortex™ Processing Service	xConnect Collection xConnect Search	`xconnect.collection.certificate` `xconnect.configuration.certificate` `xconnect.search.certificate`
Sitecore Marketing Automation Engine	xConnect Collection	`xconnect.collection.certificate`
xConnect Collection	None required - because this role does not make calls to other roles.	-
xConnect Collection Search	None required - because this role does not make calls to other roles.	-
xDB Reference Data	None required - because this role does not make calls to other roles.	-
xDB Automation Operations	xConnect Collection	`xconnect.collection.certificate`
xDB Automation Reporting	None required - because this role does not make calls to other roles.	-

You must also ensure that client certificate private keys permissions and read access are granted to the users under which your services are running. SIF does this automatically.

By default, these users are:

The ApplicationPoolIdentity for the web sites.
The Local Service account for Windows services.

Set up an SSL certificate for Solr

As described in the Install Solr section, if you want to use the Experience Database (xDB) and xConnect, you must enable SSL for Solr.

Note

In production environments, the Solr certificate must be provided and signed by an authorized provider. However, in development environments, the certificates can be generated and signed locally.

If you created a self-signed certificate, install the self-signed authority certificate for the SSL certificate in the following certificate store:

Certificates (Local Computer)\Trusted Root Certification Authorities

You must install the Solr SSL certificate for the following server roles:

XP Scaled (XP1)
Content Management xConnect Collection Search

If you have suggestions for improving this article, let us know!