Secure Server Instance Using Admin Portal

R2026b

When you install MATLAB^® Production Server™ using the on-premises Admin Portal, the Admin Portal interface provides options for enabling security, configuring client authentication, and enabling application access for specified clients.

Enable Security

To enable a server instance to use HTTPS:

1. Select the Configuration tab.

2. Open the HTTP and HTTPS menu.

3. In the Https section, enter the port number the server instance will use for receiving requests over HTTPS.

4. Open the SSL/TLS Security menu.

5. Set x509-cert-chain to the path to your server certificate chain file.

6. Set x509-private-key to the path to your private key file.

7. Click Save.

8. Restart the server instance.

Configure Client Authentication

To limit access to a server instance only to trusted clients, configure the server instance to require client authentication:

1. Select the Configuration tab.

2. Expand the SSL/TLS Security menu.

3. Set ssl-verify-peer-mode to verify-peer-require-peer-cert.

4. Configure the server instance to use the system-provided certificate authority store, a server-specific certificate authority store, or both.

   Use these configuration properties to control the certificate authority stores used by the server instance:

   • x509-ca-file-store specifies a PEM-formatted CA store for the server to use to authenticate clients.

   • x509-use-system-store directs the server instance to use the system CA store to authenticate clients.

   Note

   x509-use-system-store does not work on Windows.

5. Optionally, select the x509-use-crl property to configure the server instance to respect any certificate revocation lists (CRLs) in the CA store.

   If you do not specify this property, the server instance ignores the CRLs. This means that the server instance might authenticate clients using revoked credentials.

6. Click Save.

7. Restart the server instance.

Caution

Before you select the X509-use-crl property, you must add a CRL list to the server CA store. If the CA store does not include a CRL list, the server crashes.

Specify Client Access to Deployed Applications

By default, a MATLAB Production Server instance allows all clients to access all MATLAB programs that the instance hosts. To specify a list of allowed clients:

1. Select the Configuration tab.

2. Expand the SSL/TLS Security area.

3. Specify ssl-allowed-client as a comma-separated list of clients that can access the server instance.

   Clients are identified by the common name of their certificate.

4. Click Save.

5. Restart the server instance.

Adjust Security Protocols and Ciphers

By default, MATLAB Production Server instances try to use TLSv1.2 to secure connections between client and server. To change the list of protocols and ciphers available to the server instance:

1. Select the Configuration tab.

2. Expand the SSL/TLS Security area.

3. Specify ssl-protocols as a comma-separated list of the protocols available to the server instance.

   TLSV1.2 and TLSV1.3 are the currently supported versions.

4. Set ssl-ciphers to a comma-separated list of the cipher suites available to the server instance.

   To enable only high strength cipher suites, specify ssl-ciphers as HIGH.

5. Click Save.

6. Restart the server instance.

Improve Start Time When Security Is Enabled

A server instance that is configured to use HTTPS generates an ephemeral DH key at startup. Generating the DH key at startup provides more security than reading it from a file on disk. However, this generation can add a couple of minutes to server instance startup time.

If you need the server instance to start without delay and are not concerned about the loss of security, you can configure the server instance to read the ephemeral DH key from a file:

1. Select the Configuration tab.

2. Expand the SSL/TLS Security menu.

3. Set ssl-tmp-dh-param to the path of the file containing the DH key.

4. Click Save.

5. Restart the server instance. See Restart Server Instance.