Prepare nodes

To enable Enhanced Account Encryption (EAE) in an environment, you must first prepare the self-managed Snaplex nodes. The first time a Snaplex node starts, it generates datakeys files in the /etc/snaplogic directory on its host. The jcc-datakeys.jks file is the keystore and the jcc-datakeys.pass is the password for the keystore. You must manually copy the datakeys files from one node to all Groundplex nodes in your environment.

For TLS connections, the Snaplex also maintains SSL certificates. These aren't used for account encryption, but are also in the /etc/snaplogic directory. Don't copy them across nodes, they must be unique for each node. The jcc-serverkeys.jks file is the SSL keystore and jcc-serverkeys.pass is the password for the keystore.

Prerequisites

To configure EAE:

• Access the SnapLogic platform with Google Chrome version 37 and higher.
• The environment (Org) cannot have a mixture of self-managed Snaplexes and those managed by SnapLogic. Before enabling EAE, work with SnapLogic support to remove Cloudplexes from your environment or convert them to Groudplexes.
• Groundplex nodes must use a Java 11 JRE.
• This section covers node preparation on Windows, Linux, and Docker:
  • For Windows OS, generate the data keys on a Linux machine and copy them to the nodes running on Windows. If all of a self-managed Snaplex’s nodes are on Windows machines, install the Linux RPM (Snaplex installation package) on a Linux machine solely for the purpose of generating or updating the key store using the jcc.sh script.
  • For Linux OS, you must use the latest version of the RPM/DEB SnapLogic installer. Download the package if your Snaplex is not running the latest version. If you are setting up a new Snaplex, follow the instructions to install it first.
  • For a Docker deployment, generate the data keys inside the container the same way as on Linux. The SnapLogic image is Linux-based and runs the jcc.sh script normally, so no separate machine is needed the way Windows requires.
• Kubernetes Groundplexes use a separate Enhanced Encryption secret workflow instead of the datakeys files described here; see Deploy a Groundplex on Kubernetes.

Generate datakeys files

On a Linux machine that contains the latest Snaplex installation package, generate the key files:

1. Start or stop and restart the node. For example:

   $ sudo /opt/snaplogic/bin/jcc.sh start

2. Copy the jcc-datakeys.jks and jcc-datakeys.pass files from the /etc/snaplogic directory.
3. Follow the instructions to prepare the remaining Snaplex nodes on Linux, Windows, or Docker.

For nodes on Linux

Each machine running a node should have the same Snaplex installation as the machine where you generated the keys. If the nodes are currently running, stop them. Propagate the same datakeys files to every Snaplex in the environment:

1. Paste the generated jcc-datakeys.jks and jcc-datakeys.pass files
2. Restart each node.

During startup, the nodes upload public keys to the SnapLogic cloud. Org admins can view the keys in the Encryption Settings dialog.

For nodes on Windows

After you generate the key files on a Linux machine, use the same files for all Snaplexes in the environment:

1. Copy the jcc-datakeys.jks and jcc-datakeys.pass from the /etc/snaplogic directory of the Linux machine to a secure folder on the Windows machine. A secure folder is one that only those who work with the Snaplex nodes can access.
2. Log into the Admin Manager and add the folder name, as the value of a new SL_KEY_DIR Java property in the Snaplex configuration file:
   1. Navigate to the target Snaplex, and click it to open the Update Snaplx properties screen.
   2. Click the Node properties tab.
   3. In the Global properties field in the Key field, specify jcc.jvm_options.
   4. In the Value field, specify -DSL_KEY_DIR=folder_name and click + Add a new global property to add the values. The following example shows how to enter the value for keys stored in c:\\snaplogic_keys:
      
      
      
      
   5. Click Save.
3. Restart the SnapLogic service on all nodes with the updated slpropz configuration.

For nodes on Docker

A Docker Groundplex node can generate its own datakeys files the same way as a Linux node. The container's writable layer holds them while it's running, but that layer doesn't survive container recreation — and recreating the container is the documented step for a Docker Groundplex in Configure the JRE Version. Back up the files to a secure location outside the container so you can restore them into any future replacement container; otherwise the replacement generates its own unrelated key pair on first start and can no longer decrypt the environment's existing accounts.

1. Create a secure, permission-restricted directory on the host, and copy the files out of the container that generated them:

   mkdir -m 700 -p ~/eae-key-backup
   docker cp source_container:/etc/snaplogic/jcc-datakeys.jks ~/eae-key-backup/
   docker cp source_container:/etc/snaplogic/jcc-datakeys.pass ~/eae-key-backup/

   Keep this directory as a protected, durable backup — don't delete it after the steps below. Treat it the same as any other credential store: anyone with access to these files can decrypt the environment's protected account data.
2. Copy the files into each other Docker Groundplex node's container:

   docker cp ~/eae-key-backup/jcc-datakeys.jks other_container:/etc/snaplogic/jcc-datakeys.jks
   docker cp ~/eae-key-backup/jcc-datakeys.pass other_container:/etc/snaplogic/jcc-datakeys.pass

3. Restart each container: docker restart other_container.

docker create --name new_container other options image
docker cp ~/eae-key-backup/jcc-datakeys.jks new_container:/etc/snaplogic/jcc-datakeys.jks
docker cp ~/eae-key-backup/jcc-datakeys.pass new_container:/etc/snaplogic/jcc-datakeys.pass
docker start new_container

Next, Enable Enhanced Account Encryption.