2.6. Controlling Direct SSL Connections to Gears

In some environments, regulations may require encrypted connections between the client and the server, therefore the need for SSL connections. SSL connections to gears are either allowed, denied, or forced. By default, direct SSL connections to gears are allowed if a cartridge supports the feature and is currently only available for customized cartridges.

Enabling SSL connection allows request to the HTTP front-end to be routed as https to applications. Non-HTTP front-end ports, for example database ports, can have SSL_TO_GEAR enabled to be exposed for direct connections using the PROXY_PORTS parameter. However, this requires setting up an external router.

Configure the SSL_ENDPOINT setting in the /etc/openshift/broker.conf file to one of the following options to control access to cartridges that specify direct connections to gears:

Whether cartridges that specify direct SSL connection to the gear
are allowed, denied or forced.
SSL_ENDPOINT="deny"
SSL_ENDPOINT="force"

# Whether cartridges that specify direct SSL connection to the gear
# are allowed, denied or forced.
SSL_ENDPOINT="allow"
# SSL_ENDPOINT="deny"
# SSL_ENDPOINT="force"