Skip to content

SSL/TLS

We recommend using public TLS certificates wherever possible. Private certificates are supported, but require additional configuration during Seqera Enterprise installation and Nextflow execution.

Configure Seqera to trust your private certificate#

If you secure related infrastructure (such as private Git repositories) with certificates issued by a private Certificate Authority, these certificates must be loaded into the Seqera Enterprise containers. You can achieve this in several ways.

Configure private certificate trust
  1. This guide assumes you're using the original containers supplied by Seqera.
  2. Replace TARGET_HOSTNAME, TARGET_ALIAS, and PRIVATE_CERT.pem with your unique values.
  3. Previous instructions advised using openssl. The native keytool utility is preferred as it simplifies steps and better accommodates private CA certificates.

  1. Retrieve the private certificate on your Seqera container host:

    1
    keytool -printcert -rfc -sslserver TARGET_HOSTNAME:443  >  /PRIVATE_CERT.pem

  2. Modify the backend and cron container configuration blocks in docker-compose.yml:

     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
    CONTAINER_NAME:
  # -- Other keys here like `image` and `networks`--

  # Add a new mount for the downloaded certificate
  volumes:
    - type: bind
      source: /PRIVATE_CERT.pem
      target: /etc/pki/ca-trust/source/anchors/PRIVATE_CERT.pem

  # Add a new keytool import line PRIOR to 'update-ca-trust' for the certificate
  command: >
    sh -c "keytool -import -trustcacerts -storepass changeit -noprompt -alias TARGET_ALIAS -file /etc/pki/ca-trust/source/anchor/TARGET_HOSTNAME.pem &&
          update-ca-trust &&
          /wait-for-it.sh db:3306 -t 60 &&
          /tower.sh"

  1. Retrieve the private certificate on a machine with CLI access to your Kubernetes cluster:

    1
    keytool -printcert -rfc -sslserver TARGET_HOSTNAME:443 > /PRIVATE_CERT.pem

  2. Load the certificate as a ConfigMap in the same namespace where your Seqera instance will run:

    1
    kubectl create configmap private-cert-pemstore --from-file=/PRIVATE_CERT.pem

  3. Modify both the backend and cron Deployment objects:

    1. Define a new volume based on the certificate ConfigMap:

      1
2
3
4
5
6
7
      spec:
  template:
    spec:
      volumes:
        - name: private-cert-pemstore
          configMap:
            name: private-cert-pemstore

    2. Add a volumeMount entry into the container definition:

      1
2
3
4
5
6
7
8
9
      spec:
  template:
    spec:
      containers:
        - name: CONTAINER_NAME
          volumeMounts:
            - name: private-cert-pemstore
              mountPath: /etc/pki/ca-trust/source/anchors/PRIVATE_CERT.pem
              subPath: PRIVATE_CERT.pem

    3. Modify the container start command to load the certificate prior to running your Seqera instance:

       1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
      spec:
  template:
    spec:
      containers:
        - name: CONTAINER_NAME
          command: ["/bin/sh"]
          args:
            - -c
            - | 
                keytool -import -trustcacerts -cacerts -storepass changeit -noprompt -alias TARGET_ALIAS -file /PRIVATE_CERT.pem; 
                ./tower.sh

  1. Modify both the backend and cron Deployment objects to retrieve and load the certificate prior to running your Seqera instance:

     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
    spec:
  template:
    spec:
      containers:
        - name: CONTAINER_NAME
          command: ["/bin/sh"]
          args:
            - -c
            - | 
                keytool -printcert -rfc -sslserver TARGET_HOST:443  >  /PRIVATE_CERT.pem; 
                keytool -import -trustcacerts -cacerts -storepass changeit -noprompt -alias TARGET_ALIAS -file /PRIVATE_CERT.pem; 
                ./tower.sh

Configure the Nextflow launcher image to trust your private certificate#

If you secure infrastructure such as private Git repositories or your Seqera Enterprise instance with certificates issued by a private Certificate Authority, these certificates must also be loaded into the Nextflow launcher container.

Import private certificates via pre-run script
  1. This configuration assumes you're using the default nf-launcher image supplied by Seqera.
  2. Replace TARGET_HOSTNAME, TARGET_ALIAS, and PRIVATE_CERT.pem with your unique values.
  3. Previous instructions advised using openssl. The native keytool utility is preferred as it simplifies steps and better accommodates private CA certificates.

Add the following to your compute environment pre-run script:

1
2
3
4
5
keytool -printcert -rfc -sslserver TARGET_HOSTNAME:443  >  /PRIVATE_CERT.pem
keytool -import -trustcacerts -cacerts -storepass changeit -noprompt -alias TARGET_ALIAS -file /PRIVATE_CERT.pem

cp /PRIVATE_CERT.pem /etc/pki/ca-trust/source/anchors/PRIVATE_CERT.pem
update-ca-trust

Configure Seqera to present a SSL/TLS certificate#

You can secure your Seqera instance with a TLS certificate in several ways.

Certificate configuration options

Place a load balancer, configured to present a certificate and act as a TLS termination point, in front of your Seqera instance.

This solution is likely already implemented for cloud-based Kubernetes implementations and can be easily implemented for Docker Compose-based stacks. See this example.

This solution works well for Docker Compose-based stacks to avoid the additional cost and maintenance of a load balancer. See this example.

Due to complications that can be encountered during upgrades, this approach is not recommended.

Show me anyway

This example assumes deployment on an Amazon Linux 2 AMI.

  1. Install NGINX and other required packages:

    1
2
3
4
5
6
    sudo amazon-linux-extras install nginx1.12
sudo wget -r --no-parent -A 'epel-release-*.rpm' https://dl.fedoraproject.org/pub/epel/7/x86_64/Packages/e/
sudo rpm -Uvh dl.fedoraproject.org/pub/epel/7/x86_64/Packages/e/epel-release-*.rpm
sudo yum-config-manager --enable epel*
sudo yum repolist all
sudo amazon-linux-extras install epel -y

  2. Generate a private certificate and key.

  3. Make a local copy of the /etc/nginx/templates/tower.conf.template file from the frontend container, or create a ConfigMap to store it if you're using Kubernetes.

  4. Replace the listen directives in the server block with the following:

    1
2
3
4
5
        listen ${NGINX_LISTEN_PORT} ssl default_server;
    listen [::]:${NGINX_LISTEN_PORT_IPV6} ssl default_server;

    ssl_certificate /etc/ssl/testcrt.crt;
    ssl_certificate_key /etc/ssl/testkey.key;

  5. Modify the frontend container definition in your docker-compose.yml file or Kubernetes manifest:

     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
    frontend:
image: cr.seqera.io/frontend:${TAG}
networks:
    - frontend
environment:
  NGINX_LISTEN_PORT: 8081
  NGINX_LISTEN_PORT_IPV6: 8443
ports:
    - 8000:8081
    - 443:8443
volumes:
    - $PWD/tower.conf.template:/etc/nginx/templates/tower.conf.template
    - $PWD/cert/testcrt.crt:/etc/ssl/testcrt.crt
    - $PWD/cert/testkey.key:/etc/ssl/testkey.key
restart: always
depends_on:
    - backend

TLS version support#

Seqera Enterprise versions 22.3.2 and earlier rely on Java 11 (Amazon Corretto). You may encounter issues when integrating with third-party services that enforce TLS v1.2 (such as Azure Active Directory OIDC).

TLS v1.2 can be explicitly enabled by default using JDK environment variables:

1
_JAVA_OPTIONS="-Dmail.smtp.ssl.protocols=TLSv1.2"
Back to top