Configuring a Custom Domain
Last updated
Was this helpful?
Last updated
Was this helpful?
Out of the box, Panther ships with a self-signed certificate generated at deployment time. While this setup is better than not having SSL/TLS enabled at all on the web server, it is still far from best practice; especially for a security tool. Panther strongly recommends you replace this self-signed certificate with a certificate issued by a trusted Certificate Authority (CA) before using Panther in a production environment.
This documentation describes the process of registering a domain through Amazon Web Services (AWS) Route53, but you may use any domain registrar.
Note: If you already have a domain registered, or if you have an internal CA that manages certificates for your organization, you can skip this step
Navigate to the console and click the Registered domains tab.
Click Register domain, and enter the name of the domain you'd like to register.
Click the checkmark icon to verify that the domain is available. AWS will suggest alternatives if it is unavailable.
Click Add to cart and then Continue.
On the next form, fill in the contact information. Be sure to enter an email address that you have access to so that you can verify the domain in a future step. When you're done, click Continue.
Agree to the terms and conditions, and click Complete order. If you have not registered a domain through Route53 before, you will receive a confirmation email.
The domain will take between 10 minutes and one hour to complete registration. You can continue to the next steps before the domain registration is complete.
Navigate to the. Be sure you are in the same region that Panther is deployed in.
Click Request a certificate.
If you are using a private CA, you will need to follow the Import a certificate workflow.
Make sure the Request a public certificate option is selected and click Request a certificate.
Enter the name of the domain registered above, and click Next.
Click either DNS Validation or Email validation.
In this example, we will use Email validation.
Click Next.
Optionally add tags. Adding the tag Application:Panther will help group this certificate with the rest of the Panther product. When you are done adding tags, click Review.
Verify everything looks correct, then click Confirm and request.
You will receive an email shortly requesting verification of the certificate. Click the link in the email to confirm the certificate.
After verifying the certificate request, you will see the status of the certificate switch from Pending validation to Issued.
Be sure to note the Amazon Resource Name (ARN) of the newly-created certificate, as you will need it in the next steps.
The next step is to configure Panther to use your new certificate and domain. This can be completed with either an active Panther account or a new Panther deployment.
Find the Panther master stack (called panther by default), select this stack, and click Update.
Select the Use current template option and click Next.
Find the Parameters section and update the following two parameters:
CertificateArn: Enter the full ARN of the ACM certificate created in step two. This can be retrieved from the ACM console.
CustomDomain: Enter the domain name you registered during the first section of this documentation.
Click Next until you reach the final "Review" step.
On the "Review" step, verify that your configuration is correct. Check the box next to I acknowledge that AWS CloudFormation might..., then click Update stack.
After clicking Update stack, Panther will update with your new certificate. The update should take a few minutes.
Finally, you will need to create an alias or CNAME on your domain pointing to the load balancer's auto generated URL. If you're not using a domain registered within Route53, you should still generally be able to follow along with the steps below through your registrar's web console.
Navigate to the Hosted zones tab of Route53, and click the Hosted zone for your new domain.
Click Create Record Set.
In the popup, fill in the fields as follows:
Name: Leave this field empty.
Type: A - IPv4 address
Alias: Select Yes
Alias Target: Fill in the URL of the Elastic Load Balancer from your Panther deployment. To get this value:
Go to the EC2 service on the AWS console.
Click Load Balancers in the left sidebar menu.
Select web (if not already selected).
On the bottom of your screen, click the Description tab.
Locate the DNS Name. Copy the value from this field into the Alias Target field while creating an alias.
The value should be something like web-1xxxxxxxx.us-east-1.elb.amazonaws.com.
Routing Policy: Select Simple
Evaluate Target Health: Select No
Click Create.
You can now navigate to your new domain and reach the Panther web application over a signed and secure HTTPS connection.
Navigate to the console.
