|
| 1 | +--- |
| 2 | +title: Agent TLS Termination |
| 3 | +--- |
| 4 | + |
| 5 | +# Agent TLS Termination |
| 6 | + |
| 7 | +Agent TLS termination enables you to secure your traffic with end-to-end encryption without needing to reconfigure your server. |
| 8 | + |
| 9 | +:::tip |
| 10 | +If your service doesn't support TLS termination, you can still use Agent TLS termination with [Zero-Knowledge TLS](/traffic-policy/actions/terminate-tls/#zero-knowledge-tls). |
| 11 | +::: |
| 12 | + |
| 13 | +## Quickstart |
| 14 | + |
| 15 | +The following instructions will guide you through setting up Agent TLS termination with ngrok. |
| 16 | + |
| 17 | +### Prerequisites |
| 18 | + |
| 19 | +- [openssl](https://docs.openiam.com/docs-4.2.1.3/appendix/2-openssl) |
| 20 | + |
| 21 | +### **Step 1** – Generate a cert and key pair |
| 22 | + |
| 23 | +The following command: |
| 24 | + |
| 25 | +1. Generates a new certificate signing request (CSR) for a 4096-bit RSA key pair. |
| 26 | + - The key is saved to `your-key.key`. |
| 27 | +1. Creates a self-signed certificate which: |
| 28 | + - Is in x509 format and uses the SHA-256 hash algorithm. |
| 29 | + - Is valid for 365 days. |
| 30 | + - Is saved to `your-cert.crt`. |
| 31 | + |
| 32 | +```bash |
| 33 | +openssl req -new -newkey rsa:4096 -x509 -sha256 -days 365 -noenc -out your-cert.crt -keyout your-key.key |
| 34 | +``` |
| 35 | + |
| 36 | +### **Step 2** – Configure your endpoint |
| 37 | + |
| 38 | +You can configure your endpoint with an [agent configuration file](/agent/config/). To create a new configuration file with your generated cert and key pair, run the following command: |
| 39 | + |
| 40 | +```bash |
| 41 | +ngrok config add-authtoken you-authtoken |
| 42 | +``` |
| 43 | + |
| 44 | +Your generated configuration file should resemble the following: |
| 45 | + |
| 46 | +```yaml |
| 47 | +version: 3 |
| 48 | +agent: |
| 49 | + authtoken: your-authtoken |
| 50 | +endpoints: |
| 51 | + - name: demo-tls |
| 52 | + url: "tls://your-domain.ngrok.app" |
| 53 | + upstream: |
| 54 | + url: 12345 |
| 55 | + agent_tls_termination: |
| 56 | + server_certificate: /path/to/your-cert.crt |
| 57 | + server_private_key: /path/to/your-key.key |
| 58 | +``` |
| 59 | +
|
| 60 | +:::tip |
| 61 | +You can run `ngrok config edit` to open the configuration file in your default text editor. [Learn more about the `ngrok config` command](/agent/cli/#ngrok-config). |
| 62 | +::: |
| 63 | + |
| 64 | +### **Step 3** – Start your endpoint |
| 65 | + |
| 66 | +Next, use `ngrok start endpoint_name_here` in the terminal to start an endpoint using the settings in your agent configuration file, as shown below: |
| 67 | + |
| 68 | +```bash |
| 69 | +ngrok start demo-tls |
| 70 | +``` |
| 71 | + |
| 72 | +### **Step 4** – Start your upstream server |
| 73 | + |
| 74 | +Start an upstream server on the specified port (e.g., `12345`) to handle incoming requests. The following example uses Python, but you can use any language or framework depending on your requirements. |
| 75 | + |
| 76 | +```python |
| 77 | +import socket |
| 78 | +
|
| 79 | +host='127.0.0.1' |
| 80 | +port=12345 |
| 81 | +server = socket.socket(socket.AF_INET, socket.SOCK_STREAM) |
| 82 | +server.bind((host, port)) |
| 83 | +print(f"Server started on {host}:{port}") |
| 84 | +server.listen(1) |
| 85 | +
|
| 86 | +while True: |
| 87 | + client, client_address = server.accept() |
| 88 | + print(f"Connection established with {client_address}") |
| 89 | + client.sendall(b"hello, world!") |
| 90 | + client.close() |
| 91 | + print(f"Connection with {client_address} closed") |
| 92 | +``` |
| 93 | + |
| 94 | +### **Step 5** – Try connecting to your endpoint |
| 95 | + |
| 96 | +The following example uses `openssl s_client` to initiate an SSL/TLS client connection to your upstream server without a certificate. |
| 97 | + |
| 98 | +```bash |
| 99 | +openssl s_client -quiet -connect your-domain.ngrok.app:443 -verify_return_error |
| 100 | +``` |
| 101 | + |
| 102 | +```bash |
| 103 | +Connecting to 2600:1f16:d83:1200::6e:0 |
| 104 | +depth=0 C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=your-domain.ngrok.app |
| 105 | +verify error:num=18:self-signed certificate |
| 106 | +408FB6F801000000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:2093: |
| 107 | +``` |
| 108 | + |
| 109 | +The following example uses `openssl s_client` to initiate an SSL/TLS client connection to your upstream server with a certificate. |
| 110 | + |
| 111 | +```bash |
| 112 | +openssl s_client -quiet -connect your-domain.ngrok.app:443 -verify_return_error -CAfile your-cert.crt |
| 113 | +``` |
| 114 | + |
| 115 | +```bash |
| 116 | +Connecting to 2600:1f16:d83:1200::6e:0 |
| 117 | +depth=0 C=AU, ST=Some-State, O=Internet Widgits Pty Ltd, CN=your-domain.ngrok.app |
| 118 | +verify return:1 |
| 119 | +hello, world!% |
| 120 | +``` |
| 121 | + |
| 122 | +:::note |
| 123 | +The extra arguments added to the command suppress most of the output so that only the data exchanged with the server will be displayed. |
| 124 | +::: |
| 125 | + |
| 126 | +## Mutual TLS example |
| 127 | + |
| 128 | +The following instructions will guide you through setting up Agent TLS termination using [Mutual TLS (mTLS)](/guides/other-guides/using-tls-mutual-authentication/) with ngrok. |
| 129 | + |
| 130 | +### **Step 1** – Generate a root CA private key and certificate |
| 131 | + |
| 132 | +```yaml |
| 133 | +openssl genpkey -algorithm RSA -out your-ca.key -pkeyopt rsa_keygen_bits:2048 |
| 134 | +openssl req -x509 -new -nodes -key your-ca.key -sha256 -days 365 -out your-ca.crt -subj "/CN=YourDemoCA" |
| 135 | +``` |
| 136 | + |
| 137 | +### **Step 2** – Generate server credentials |
| 138 | + |
| 139 | +The following terminal commands will generate these server credentials: |
| 140 | + |
| 141 | +- A server private key |
| 142 | +- A CSR |
| 143 | +- A signed certificate |
| 144 | + |
| 145 | +```bash |
| 146 | +openssl genpkey -algorithm RSA -out your-server.key -pkeyopt rsa_keygen_bits:2048 |
| 147 | +openssl req -new -key your-server.key -out your-server.csr -subj "/CN=your-domain.ngrok.app" |
| 148 | +openssl x509 -req -in your-server.csr -CA your-ca.crt -CAkey your-ca.key -CAcreateserial -out your-server.crt -days 365 -sha256 |
| 149 | +``` |
| 150 | + |
| 151 | +### **Step 3** – Generate client credentials |
| 152 | + |
| 153 | +The following terminal command will generate these client credentials: |
| 154 | + |
| 155 | +- A private key |
| 156 | +- A CSR |
| 157 | +- A signed certificate |
| 158 | + |
| 159 | +```yaml |
| 160 | +openssl genpkey -algorithm RSA -out your-client.key -pkeyopt rsa_keygen_bits:2048 |
| 161 | +openssl req -new -key your-client.key -out your-client.csr -subj "/CN=YourDemoCA" |
| 162 | +openssl x509 -req -in your-client.csr -CA your-ca.crt -CAkey your-ca.key -CAcreateserial -out your-client.crt -days 365 -sha256 |
| 163 | +``` |
| 164 | + |
| 165 | +### **Step 4** – Configure your mTLS endpoint |
| 166 | + |
| 167 | +Use the following command to create an agent configuration file with your generated certificates: |
| 168 | + |
| 169 | +```bash |
| 170 | +ngrok config add-authtoken you-authtoken |
| 171 | +``` |
| 172 | + |
| 173 | +Your generated configuration file should resemble the following: |
| 174 | + |
| 175 | +```yaml |
| 176 | +version: 3 |
| 177 | +agent: |
| 178 | + authtoken: your-token |
| 179 | +endpoints: |
| 180 | + - name: demo-mtls |
| 181 | + url: "tls:/your-domain.ngrok.app" |
| 182 | + upstream: |
| 183 | + url: 8080 |
| 184 | + agent_tls_termination: |
| 185 | + server_certificate: /path/to/your-cert.crt |
| 186 | + server_private_key: /path/to/your-key.key |
| 187 | + mutual_tls_certificate_authorities: |
| 188 | + - /path/to/your-ca.crt |
| 189 | +``` |
| 190 | + |
| 191 | +### **Step 5** – Start your mTLS endpoint |
| 192 | + |
| 193 | +Next, use `ngrok start endpoint_name_here` in the terminal to start an endpoint using the settings in your agent configuration file, as shown below: |
| 194 | + |
| 195 | +```bash |
| 196 | +ngrok start demo-mtls |
| 197 | +``` |
| 198 | + |
| 199 | +### **Step 6** – Start your upstream server |
| 200 | + |
| 201 | +Start an upstream server on the specified port (e.g., `12345`) to handle incoming requests. The following example uses Python, but you can use any language or framework depending on your requirements. |
| 202 | + |
| 203 | +```python |
| 204 | +import socket |
| 205 | +
|
| 206 | +host='127.0.0.1' |
| 207 | +port=12345 |
| 208 | +server = socket.socket(socket.AF_INET, socket.SOCK_STREAM) |
| 209 | +server.bind((host, port)) |
| 210 | +print(f"Server started on {host}:{port}") |
| 211 | +server.listen(1) |
| 212 | +
|
| 213 | +while True: |
| 214 | + client, client_address = server.accept() |
| 215 | + print(f"Connection established with {client_address}") |
| 216 | + client.sendall(b"hello, world!") |
| 217 | + client.close() |
| 218 | + print(f"Connection with {client_address} closed") |
| 219 | +``` |
| 220 | + |
| 221 | +### **Step 7** – Try connecting to your mTLS endpoint |
| 222 | + |
| 223 | +The following example uses `openssl s_client` to initiate an SSL/TLS client connection to your upstream server without a certificate. |
| 224 | + |
| 225 | +```bash |
| 226 | +openssl s_client -quiet -connect your-domain.ngrok.app:443 -verify_return_error |
| 227 | +``` |
| 228 | + |
| 229 | +```bash |
| 230 | +Connecting to 2600:1f16:d83:1200::6e:3 |
| 231 | +depth=0 CN=your-domain.ngrok.app |
| 232 | +verify error:num=20:unable to get local issuer certificate |
| 233 | +408FB6F801000000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:2093 |
| 234 | +``` |
| 235 | + |
| 236 | +The following example uses `openssl s_client` to initiate an SSL/TLS client connection to your upstream server with a certificate. |
| 237 | + |
| 238 | +```bash |
| 239 | +openssl s_client -quiet -connect your-domain.ngrok.app:443 -verify_return_error -CAfile your-ca.crt |
| 240 | +``` |
| 241 | + |
| 242 | +```bash |
| 243 | +Connecting to 2600:1f16:d83:1200::6e:3 |
| 244 | +depth=1 CN=YourDemoCA |
| 245 | +verify return:1 |
| 246 | +depth=0 CN=your-domain.ngrok.app |
| 247 | +verify return:1 |
| 248 | +hello, world!% |
| 249 | +``` |
0 commit comments