Modifying Message Bus configuration settings

The information on this page will help you configure Message Bus for your server environment. In its simplest default configuration, Message Bus just works as long as the IANA-assigned port for MQTT (port 1883 for unencrypted, or port 8883 for TLS-encrypted) is open on all Venafi servers. That means you don't necessarily need to configure Message Bus after installation or upgrade.

This topic discusses additional configuration options related to Message Bus you can make in Venafi Configuration Console post installation (or upgrade).

To modify Message Bus configuration settings

  1. On one of the Venafi servers in your cluster, open Venafi Configuration Console.

  2. While on the root node, click the Configure Message Bus action in the Actions panel.

  3. Verify the port number.

    Venafi Platform automatically assigns the default MQTT port for encrypted or unencrypted traffic, depending on your TLS setting. You likely won't need to modify this setting.

  4. [Optional] If you require unencrypted communication between servers, Disable TLS.

  5. For Self-Hosted (Mesh) connections between servers:

    1. Click the Self-Hosted (Mesh) option, if not already selected.

    2. If you need to change the hostname, click Override Hostname.

      1. Review the Detected name. This is the name that Venafi Configuration Console detected for this host. You can't edit this field.

      2. Enter a fully-qualified domain name to use to connect to this server in the Override with field.

      3. Click Save.

    3. Click Save.

    4. Ensure all servers in the cluster can communicate to each other using the selected port. In mesh mode all servers need to be able to reach all other servers in the cluster over the specified port. The Message Bus node in VCC will help you identify any communication issues between servers in the cluster.

      That is all that is needed to configure Message Bus in mesh mode. You can skip the next step.

  6. For Central MQTT Broker (Hub & Spoke) connections between servers:

    1. In the Central MQTT Broker field, enter the URL of the central MQTT broker.
    2. If multiple clusters of Venafi servers are sharing the same central MQTT broker, select a unique ID for this cluster. This will ensure the bus correctly interprets which bus messages are intended for this particular server cluster. Other clusters must use a different ID.

      For example, if you have a cluster in your development environment and a different cluster in your production environment sharing the same broker, you would assign different ID values to these clusters so the subscribers can differentiate between clusters.

    3. Make sure the servers can reach the central MQTT broker over the specified port by ensuring the firewall is configured to allow traffic over that port.

      It's easy to see if there are communication issues if you look at the bus overview. If you see all green check marks your ports are configured correctly. If you see red X marks, there is additional information to help you diagnose the issue. See Working with Message Bus for details on viewing communication status and diagnosing potential issues.

    4. If your broker requires authentication, select an MQTT Authentication type.

      1. To use a user name an password:

        • Click the Username option.

        • Add your Username and Password.

      2. To use a certificate:

        1. Click the Certificate option.

        2. Click the Load PFX button.

        3. Browse to the location of your PFX file and select it.

        4. Enter the Password for your PFX file.

          The certificate loads, and you can see its data.

        5. If this is the correct certificate, click Ok.

    5. Click Validateto verify communication with the central broker.