Configuring SSL for the Checkmarx Software Exposure Platform

If CA certificate and Test VMs are of different domains, you need to change Test VMs domain before starting with the configuration, use below steps for the same,

Update ExternalListenUrls to reflect IIS configured bindings:

http(s)://*(port)

Example: "ExternalListenUrls": "https://*:443"

If more than one binding is configured:

http(s)://*(port);http(s)://*(port)

Example: "ExternalListenUrls": "https://*:443;https://*:123"

SQL Query to view current values:

SELECT * FROM [CxDB].[dbo].[CxComponentConfiguration] WHERE [Key] = 'IdentityAuthority'

SELECT * FROM [CxDB].[dbo].[CxComponentConfiguration] WHERE [Key] = 'CxARMPolicyURL'

SELECT * FROM [CxDB].[dbo].[CxComponentConfiguration] WHERE [Key] = 'CxARMURL'

SELECT * FROM [CxDB].[dbo].[CxComponentConfiguration] WHERE [Key] = 'CxSASTManagerUri'

SELECT * FROM [CxDB].[dbo].[CxComponentConfiguration] WHERE [Key] = 'WebServer'

SQL Queries to set URL’s to SSL:

UPDATE [CxDB].[dbo].[CxComponentConfiguration]

SET [Value] = 'https://{server FQDN}/CxRestAPI/auth'

WHERE [Key] = 'IdentityAuthority'

UPDATE [CxDB].[dbo].[CxComponentConfiguration]

SET [Value] = 'https://{server FQDN}:8443'

WHERE [Key] = 'CxARMPolicyURL'

UPDATE [CxDB].[dbo].[CxComponentConfiguration]

SET [Value] = 'https://{server FQDN}:8443'

WHERE [Key] = 'CxARMURL'

UPDATE [CxDB].[dbo].[CxComponentConfiguration]

SET [Value] ='https://{server FQDN}'

WHERE [Key] = 'CxSASTManagerUri'

UPDATE [CxDB].[dbo].[CxComponentConfiguration]

SET [Value] = 'https://{server FQDN}'

WHERE [Key] = 'WebServer'

Example:

UPDATE [CxDB].[dbo].[CxComponentConfiguration]

SET [Value] = 'https://cxsast.checkmarx.net/CxRestAPI/auth'

WHERE [Key] = 'IdentityAuthority'

UPDATE [CxDB].[dbo].[CxComponentConfiguration]

SET [Value] = 'https://cxsast.checkmarx.net:8443'

WHERE [Key] = 'CxARMURL'

                  worker_processes  1;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;

        upstream gol-ha2-lb.cxquality.com {
                ip_hash;
                server gol-ha2-mn1.cxquality.com:443;
                server gol-ha2-mn2.cxquality.com:443;
        }
        
    server {
                listen       80;
                listen       443 ssl;
                server_name gol-ha2-lb.cxquality.com;
                
                ssl_certificate Cert/newcert.cer;
                ssl_certificate_key Cert/newkey2.key;
                
                ssl_protocols TLSv1.2;
                ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
                ssl_prefer_server_ciphers on;
                add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
                
                ssl_session_timeout 5m;
                ssl_session_cache shared:SSL:50m;
                ssl_session_tickets off;
                server_tokens off;

location / {
            root   html;
            index  index.html index.htm;
                        proxy_pass https://gol-ha2-lb.cxquality.com/;
        }
    }
}