Web Server Configurations
For API providers who are setting up a web server to respond to API requests over MV-SIPN, it is important to set up a mutually trusted connectivity between the web server and Swift. Follow the guide below to set up the web server certificate.
You can configure multiple web servers for load balancing, see more on Session Distribution.
Step 1: Create Web Server certificate
We recommend creating two certificates, one for the Pilot environment and another for the Live environment. Follow the steps in Web server certificates to create them.
Step 2: Install the Swift CA Certificate in the Web Server
You can skip this step if you have completed this set up during the creation of the web server certificate, Otherwise, refer to Install the Swift CA Certificate in the Web Server.
Step 3: Set Up a 2-Way TLS Connectivity
Refer to your web server provider’s documentation if you are using a web server that is not covered below. Follow the steps to enable client authentication on the Apache WebServer (HTTPD) and Apache Tomcat Server.
Using Apache WebServer (HTTPD) on RHEL
1Make sure that you have the following RHEL packages installed.- Check if you have installed the ssl pacakge.
> rpm -qa | grep mod_ssl
> mod_ssl-2.4.6-88.el7.x86_64- Check if you have installed the httpd package.
> rpm -qa | grep httpd
> httpd-2.4.6-88.el7.x86_64| Parameters | Examples |
|---|---|
| SSLCertificateFile PATH-TO-SERVER-CERT-FILE | SSLCertificateFile /tmp/server.pem |
| SSLCertificateKeyFile PATH-TO-SERVER-PRIVATE-KEY-FILE | SSLCertificateKeyFile /tmp/server.key |
| SSLCACertificateFile PATH-TO-CA-CERT-FILE | SSLCACertificateFile /tmp/ca.pem |
SSLVerifyClient require> systemctl restart
> httpd systemctl status httpdUsing Apache Tomcat Server on RHEL
1Open the server.xml file under CATALINA_BASE/conf or CATALINA_HOME/conf. 2Add the following elements in the connector element of the server.xml file. 3Restart the Apache Tomcat Server.Step 4: Configure the Web Server
1Configure your web server to ensure the correct endpoint URLs are available. There is a mandatory Health Check endpoint (/ping) that should be configured along with other endpoints your institution provided in the e-form during registration. Examples of the Health Check endpoint URLs include the following.| Environments | Health check URLs |
|---|---|
| Pilot | Your BIC8-API service name-pilot.swiftnet.sipn.swift.com/ping |
| Live | Your BIC8-API service name.swiftnet.sipn.swift.com/ping |
| Environments | Swift API Gateway certificate DNs |
|---|---|
| Pilot | cn=api-test-gw.swiftnet.sipn.swift.com,ou=operational,o=swift,c=ww |
| Live | cn=api-gw.swiftnet.sipn.swift.com,ou=operational,o=swift,c=ww |
Step 5: Set Up Network/Firewall Configuration Towards Your Web Server
Your institution is responsible for making sure that your network set-up adheres to the recommendations outlined in the Network Configuration Tables Guide for Swift Web Access Service Providers. Pay attention to network and firewall configuration for communications between your web server and MV-SIPN.