Welcome to the Alteryx Knowledge Base

• Alteryx License Server 2021.4+
• TLS certificate with private key attached (.pfx file)
• DER encoded TLS certificate (instructions included)

(Optional) Creating a Self Signed .pfx file using OpenSSL

The following commands will generate a private key, a certificate signing request, a certificate, and a pfx.

openssl ecparam -out filename.key -name secp384r1 -genkey
openssl req -config openssl-new.cfg -new -nodes -sha384 -key filename.key -out filename.csr
openssl x509 -req -days 90 -sha384 -in filename.csr -signkey filename.key -out filename.crt -extensions v3_req -extfile openssl-new.cfg
openssl pkcs12 -export -out filename.pfx -inkey filename.key -in filename.crt

Creating the Alteryx License Server keystore file

Note: In the command below, we have jre-8u351 installed. Since the Alteryx License Server works under different distributions of Java, please verify the location of the keytool.exe file and update the below command accordingly. The keytool can normally be found in "%installation directory%\Java\<distribution version>\bin".

"C:\Program Files\Java\jre1.8.0_341\bin\keytool.exe" -importkeystore -srckeystore D:\TLS\servername.pfx -srcstoretype pkcs12 -destkeystore "C:\Program Files\Alteryx\LicenseServer\server\servername.keystore" -deststoretype pkcs12

  The output of the above command should look something like the following:

D:\>"C:\Java\jdk-11\bin\keytool.exe" -importkeystore -srckeystore D:\TLS\servername.pfx -srcstoretype pkcs12 -destkeystore "C:\Program Files\Alteryx\LicenseServer\server\servername.keystore" -deststoretype pkcs12
Importing keystore D:\TLS\pod-2871726.pfx to D:\Alteryx\LicenseServer\server\pod-2871726.keystore...
Enter destination keystore password: <new keystore password>
Re-enter new password: <new keystore password>
Enter source keystore password: <password for .pfx file>
Entry for alias 1 successfully imported.
Import command completed:  1 entries successfully imported, 0 entries failed or cancelled

Modifying the local-configuration.yaml file to point to the new keystore

Open the local-configuration.yaml found in %install-dir%\Alteryx\LicenseServer\Server in a text editor and make the following changes below:

# HTTPS server mode

https-in:

# Set to true to enable

 enabled: true #original value: false

 # HTTPS listening port

  port: 1443

  # Path to keystore

  keystore-path: "C:\\Program Files\\Alteryx\\LicenseServer\\server\\filename.keystore" #original value: path-to-your-keystore

  # Keystore password. You can obfuscate this with java -jar flexnetls.jar -password your-password-here

  keystore-password: MyKeystorePassword  #original value: changeit

Notes: The double backslashes in the keystore path are required for the keystore to be read correctly.  Port 1443 is not required in the above configuration and can be edited to 443 if desired.  If you would prefer not to store your password in plain text, you can obfuscate your password with the following Java command,
 

java -jar flexnetls.jar -password your-password-here

You will need to change into the server folder of your Alteryx License Server install directory first. For example:
 

cd "\Program Files\Alteryx\LicenseServer\server" 

This will return a value like: OBF:1c4x1z7k1xtp1ku71kqn1xtt1z7i1c25.  You will need to include the OBF: piece as well when adding this value to the local-configuration.yaml file.

Adding the certificate to the Java Keystore

In order to execute the local Alteryx License Server commands, the TLS certificate also needs to be added to the Java Keystore. As with the note above, the folder where the cacerts file (the Java keystore) is located in, will depend on the distribution of Java being used.  The default password for the cacerts file is changeit.  If this has been modified, update the command below to reflect the new password.

"C:\Program Files\Java\jre1.8.0_341\bin\keytool.exe" -import -trustcacerts -alias alteryxlicenseserver -file D:\TLS\filename.cer -keystore "C:\Program Files\Java\jre1.8.0_341\lib\security\cacerts" -storepass changeit

Note: The Java Keystore requires the certificate to be in the CER (encoded with DER) format.  This can be easily done by importing the certificate into the Windows Keystore and then Exporting the certificate in the required format.

1. Type "Internet Options" in the Windows Search Box and click on the Internet Options application listed
2. Click on the Content Tab
3. Click on Certificates
4. Click on the Other People tab and click Import to start the Certificate Import Wizard
5. Step through to add your certificate to the local trust store
6. Click on the newly added certificate and click Export to open the Certificate Export Wizard
7. Select DER encoded binary X.509 (.CER) from the format list and finish through the wizard.
    

Start the Alteryx License Server
Click the Windows icon in the taskbar and type "services.msc" to open the Services console. 
Click the AlteryxService service
Click the Start link in the left pane of the Service console

Note: The Alteryx License Server can take a few minutes to actually start up, even if it is listed as Running in the Services Console.  

openssl-new.cfg file used in generating the Self Signed Certificate

[req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[ dn ]
C=US
ST=CO
L=Broomfield
O=Alteryx
OU=Support
emailAddress=email@domain.com
CN=servername1.domain.tld

[ req_ext ]
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[ alt_names ]
DNS.1=servername1.domain.tld
DNS.2=servername2.domain.tld
DNS.3=servername3.domain.tld

[ v3_req ]
subjectAltName = @alt_names