Posit Team SSL Considerations

When using an SSL certificate in your Posit Workbench, Connect, or Package Manager, it is important to note that there are many components to consider when choosing which certificate to use, and how it should be configured.

Self-Signed vs CA Signed

CA signed certificates make it easy to implement transport layer security (TLS), however they are more costly. Adversely, self-signed certificates are more configurable, and cheaper, but require more work to be trusted by 3rd parties. 

CA Signed Certificates

If using a CA signed certificate, there aren't any other considerations to make during the implementation process. You must only ensure that the full certificate chain (from the server certificate, any subordinate issuer certificates, and the root certificate) are placed in the certificate file on the server. You can follow the guides here on how to set up SSL, depending on the type of product you are using:

Posit Workbench

https://docs.posit.co/rsw/configuration/ssl-certificates/

Posit Connect

https://docs.posit.co/rsc/configuration/ssl-certificates/

Posit Package Manager

https://docs.posit.co/rpm/configuration/ssl-certificates/

Self-Signed Certificates

If using a self-signed certificate, there are a couple of more settings that we need to consider. As a first step, it is essential that your organization has a policy in place that allows other devices within your organization to trust the self-signed certificates that you've generated. This is usually completed by an Active Directory policy, however, check with your IT team if you're unsure that this is in place. If the other servers in your domain don't trust the certificate used by the Posit software, then communicating with other servers will prove troublesome, and you will run into connection issues along the way.

When using self-signed certificates, it's useful to have OpenSSL installed. To do so, will depend on your Linux distribution:

Ubuntu/Debian

sudo apt-get install libssl-dev

Redhat/CentOS

sudo yum install libssl-devel

Once installed, we can proceed to the next step.

Remove any passphrases from your SSL certificates

Firstly, we need to ensure that our certificate does not have a passphrase associated with it. Once we have OpenSSL installed, we can run the following commands to remove the passphrase from our certificate:

openssl rsa -in [original.key] -out [new.key]

For example;

openssl rsa -in /path/to/selfcert.crt -out /path/to/selfcert1.crt

Note that in the example above, we renamed the certificate file from selfcert.crt to selfcert1.crt. If you choose to use the same name in the command, then the previous selfcert.crt file will be overwritten and the passphrase will be removed.

Add your certificate to the trusted certificate store on your server

Ubuntu/Debian

For Debian and Ubuntu-based distributions, this is located in the following directory:

/usr/local/share/ca-certificates/

You will need to copy the certificate file into this directory.

cp /path/to/selfcert.crt /usr/local/share/ca-certificates

Then, update the trusted certificates on your system:

sudo update-ca-certificates

Red Hat/CentOS

For RHEL based distributions, this is located in the following directory:

/etc/pki/ca-trust/source/anchors/

You will need to copy the certificate file into this directory.

cp /path/to/selfcert.crt /etc/pki/ca-trust/source/anchors

Then, update the trusted certificates on your system:

update-ca-trust extract

Support Ticket

If you still have issues after completing the above, you can always lodge a support ticket, where our group of friendly, and incredibly knowledgeable staff can assist with any issues that you may be having. You can submit a ticket here:

https://support.posit.co/hc/en-us/requests/new