Attempting to connect to the SWIS REST endpoint fails because of a self-signed certificate

1/10/2022 3:56 PM

6/22/2022 11:48 AM

With Orion Platform version 2020.2.6, attempting to connect to the SWIS REST endpoint using port 17778 fails.

Orion Platform

The SWIS REST endpoint is secured with a self-signed certificate, which is by default invalid.

You can configure a work-around for this issue by defining an SSL termination proxy with a custom SSL certificate. Then configure rules on the proxy site to reroute traffic to the SWIS REST endpoint.

1. Download and install Microsoft Application Request Routing (ARR) 3 for IIS. The download site is https://www.microsoft.com/en-us/download/details.aspx?id=47333 (© 2021 Microsoft, available at https://www.microsoft.com, obtained on December 30, 2021).

2. Download and install the IIS URL Rewrite Module. The download link is https://download.microsoft.com/download/1/2/8/128E2E22-C1B9-44A4-BE2A-5859ED1D4592/rewrite_amd64_en-US.msi (© 2021 Microsoft, available at https://www.microsoft.com, obtained on December 30, 2021).
3. Set up ARR flags for accepting certificates:
   1. Open the Command Prompt as an administrator.

   2. Run the following command:

      reg.exe add "HKLM\SOFTWARE\Microsoft\IIS Extensions\Application Request Routing\Parameters" /v SecureConnectionIgnoreFlags /t REG_DWORD /d 0x1100

4. Open IIS Manager (open the Start menu and enter Internet Information Service Manager).
5. Configure Application Request Routing:
   1. In the navigation tree on the left, click the root item (the machine name).
   2. In the IIS section, double-click Application Request Routing Cache.
   3. In the right panel, click Server Proxy Settings.
   4. Select Enable proxy.
   5. In the right panel, click Apply.
6. Configure the HTTPS listener:
   1. In the IIS navigation tree on the left, click Sites.

   2. In the right panel, click Add Website.

      The Add Website dialog box opens.

   3. In the Site name field, enter SwisProxy.
   4. In the Physical path field, enter C:\inetpub\SwisProxy. (Create this folder if it does not exist.)
   5. Under Type, select HTTPS from the Type drop-down menu.
   6. Select your SSL certificate from the SSL Certificate drop-down menu.
   7. Click OK.
7. Configure forwarding:
   1. Open the C:\inetpub\SwisProxy folder.

   2. In a text editor, create a file named web.config, and add the following content:

      <?xml version="1.0" encoding="UTF-8"?>
      <configuration>
      <system.webServer>							
      <rewrite>							
      <rules>							
      <rule name="ReverseProxyInboundRule1" stopProcessing="true">							
      <match url="(.*)" />							
      <conditions>							
      <add input="{CACHE_URL}" pattern="^(https?)://" />							
      </conditions>							
      <action type="Rewrite" url="{C:1}://127.0.0.1:17778/{R:1}" />
      </rule>							
      </rules>							
      </rewrite>							
      </system.webServer>							
      </configuration>														

   3. Save the file and close it.

Verify that the setup works

Access following addresses from a browser. Enter the Orion web credentials when prompted:

• Original address:

  https://localhost:17778/SolarWinds/InformationService/v3/Json/Query?query=SELECT+NodeId+FROM+Orion.Nodes

• New address (the outcome of the workaround):

  https://localhost/SolarWinds/InformationService/v3/Json/Query?query=SELECT+NodeId+FROM+Orion.Nodes

In both cases the outcome should be the same JSON file, depending on number of nodes in Orion database. For example:

{"results":[
{"NodeId":1}
]}