TLS certificates

What you will do: serve the console, the API and the HTTP/S listeners with a certificate your users and shippers trust.

Every user-to-system and inter-component connection runs over HTTPS/TLS with your keys, certificates and security configuration; XPLG never holds your keys. The cryptographic modules are current Java releases with JCE "in accordance with FIPS 140-2 Level 2" (no FIPS certificate is claimed). Both generations ship with a self-signed certificate, which browsers treat as untrusted — replace it before anyone but you uses the deployment.

V7: the Tomcat connector

You need a keystore that holds the whole certificate chain plus the matching private key — Tomcat accepts .jks and .pfx — its password, and optionally the key alias and key password (without an alias, the first key in the keystore is used). A single .cer is not enough: build a .pfx from it first.

1. Copy the keystore under <install dir>/ServletContainer/.
2. Edit <install dir>/ServletContainer/conf/server.xml and, on the HTTPS connector (port="30443"), keep its existing attributes, make sure it carries SSLEnabled="true", scheme="https", secure="true" and sslProtocol="TLSv1.2", and set the certificate:

<Connector SSLEnabled="true" port="30443" scheme="https" secure="true"
  protocol="org.apache.coyote.http11.Http11NioProtocol" sslProtocol="TLSv1.2" xpolog="ssl" ...>
  <SSLHostConfig>
    <Certificate certificateKeystoreFile="/<install dir>/ServletContainer/<keystore>"
      certificateKeystorePassword="<keystore password>"
      certificateKeyAlias="<alias>" certificateKeyPassword="<key password>" />
  </SSLHostConfig>
</Connector>

For a .pfx add certificateKeystoreType="PKCS12" to the Certificate element.

3. Save, restart the XPLG service, open https://<host>:30443/logeye/ and confirm the browser shows your certificate.
4. Turn off plain HTTP: under Settings > System Settings set the HTTP port to 0 and save. The ports themselves are changed on the same page.

The steps are the same on Windows and Linux and apply to Java 17 with Tomcat 10 (every build since patch 9001). For an older installation contact support.

X8: the Traefik edge

conf/dynamic/ is a watched Traefik file-provider directory; xplg-routes.yml in it is generated and must never be edited. Add your certificate in a separate file:

cp fullchain.pem privkey.pem conf/ssl/
cat > conf/dynamic/tls.yml <<'EOT'
tls:
  certificates:
    - certFile: /etc/traefik/ssl/fullchain.pem
      keyFile:  /etc/traefik/ssl/privkey.pem
EOT

Traefik picks it up within seconds, without a restart. Until then it serves its own self-signed certificate, which is why curl -k works out of the box. How the per-role HTTPS ports (30444–30448) get a certificate is not documented — put the edge in front of the roles and publish the edge.

Beyond the console

• HTTP/S listeners use whatever protocol the server is configured for: once the console is on HTTPS, shippers post to https://<host>:<port>/logeye/api/logger.jsp?token=…. In Fluent Bit set tls On and the HTTPS port (a tls On output to port 30303 delivers nothing); use curl -k only to test a self-signed certificate. See Fluent Bit.
• The SDK needs a .keystore file next to xpologClient.jar for HTTPS; the SDK download ships one.
• Instance to instance. Remote XPLG accounts choose HTTP or HTTPS as the connection type; use HTTPS for Agent Mode instances and Flux agents.
• Directories and brokers. Active Directory over ldaps://<server>:636/; the Kafka listener with SASL_SSL on 9093 (Azure Event Hubs).
• Forwarders to SIEM and observability targets send over HTTP/S with built-in encryption and compression; see Destinations.
• Secrets. Collection and forwarding credentials live encrypted in the Address Book, never in plain text.

Certificate and HTTPS errors are on Start-up and access.

Next: AWS Marketplace

Source: XPLG wiki, pages 1707180033, 3150544899, 3161489464, 1598685520, 2053865492, 1919418369, 1597014018, 1730052097, 1594133404, 3151659011, 1708130305 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1707180033). Pending from XPLG engineering: replacing the certificate on the X8 per-role HTTPS ports.