Google Git
Sign in
apache / trafficcontrol-website / 91716725350ee8ad6edf196b035dd8e94dc3e923 / . / docs / 1.7.0 / admin / traffic_router.html
blob: dad7e423dc378122d6b6367d17cd0909bcc2d060 [file] [log] [blame]
<!DOCTYPE html>
<!--[if IE 8]><html class="no-js lt-ie9" lang="en" > <![endif]-->
<!--[if gt IE 8]><!--> <html class="no-js" lang="en" > <!--<![endif]-->
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Traffic Router Administration &mdash; Traffic Control 1.7 documentation </title>
<link rel="shortcut icon" href="../_static/favicon.ico"/>
<link rel="stylesheet" href="../_static/css/theme.css" type="text/css" />
<link rel="stylesheet" href="../_static/theme_overrides.css" type="text/css" />
<link rel="top" title="Traffic Control 1.7 documentation" href="../index.html"/>
<link rel="up" title="Administrator’s Guide" href="index.html"/>
<link rel="next" title="Traffic Stats Administration" href="traffic_stats.html"/>
<link rel="prev" title="Traffic Monitor Administration" href="traffic_monitor.html"/>
<script src="_static/js/modernizr.min.js"></script>
</head>
<body class="wy-body-for-nav" role="document">
<div class="wy-grid-for-nav">
<nav data-toggle="wy-nav-shift" class="wy-nav-side">
<div class="wy-side-nav-search">
<a href="/" class="icon icon-home"> Traffic Control
<img src="../_static/tc_logo.png" class="logo" />
</a>
<div role="search">
<form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
<input type="text" name="q" placeholder="Search docs" />
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
</div>
</div>
<div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="main navigation">
<ul>
<li class="toctree-l1"><a class="reference internal" href="../basics/index.html">CDN Basics</a><ul>
<li class="toctree-l2"><a class="reference internal" href="../basics/content_delivery_networks.html">Content Delivery Networks</a></li>
<li class="toctree-l2"><a class="reference internal" href="../basics/http_11.html">HTTP 1.1</a></li>
<li class="toctree-l2"><a class="reference internal" href="../basics/caching_proxies.html">Caching Proxies</a></li>
<li class="toctree-l2"><a class="reference internal" href="../basics/cache_revalidation.html">Cache Control Headers and Revalidation</a></li>
</ul>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../overview/index.html">Traffic Control Overview</a><ul>
<li class="toctree-l2"><a class="reference internal" href="../overview/introduction.html">Introduction</a></li>
<li class="toctree-l2"><a class="reference internal" href="../overview/traffic_ops.html">Traffic Ops</a></li>
<li class="toctree-l2"><a class="reference internal" href="../overview/traffic_portal.html">Traffic Portal</a></li>
<li class="toctree-l2"><a class="reference internal" href="../overview/traffic_router.html">Traffic Router</a></li>
<li class="toctree-l2"><a class="reference internal" href="../overview/traffic_monitor.html">Traffic Monitor</a></li>
<li class="toctree-l2"><a class="reference internal" href="../overview/traffic_stats.html">Traffic Stats</a></li>
<li class="toctree-l2"><a class="reference internal" href="../overview/traffic_server.html">Traffic Server</a></li>
<li class="toctree-l2"><a class="reference internal" href="../overview/traffic_vault.html">Traffic Vault</a></li>
</ul>
</li>
</ul>
<ul class="current">
<li class="toctree-l1 current"><a class="reference internal" href="index.html">Administrator&#8217;s Guide</a><ul class="current">
<li class="toctree-l2"><a class="reference internal" href="traffic_ops_install.html">Installing Traffic Ops</a></li>
<li class="toctree-l2"><a class="reference internal" href="traffic_ops_config.html">Configuring Traffic Ops</a></li>
<li class="toctree-l2"><a class="reference internal" href="traffic_ops_using.html">Using Traffic Ops</a></li>
<li class="toctree-l2"><a class="reference internal" href="traffic_ops_extensions.html">Managing Traffic Ops Extensions</a></li>
<li class="toctree-l2"><a class="reference internal" href="traffic_portal.html">Traffic Portal Administration</a></li>
<li class="toctree-l2"><a class="reference internal" href="traffic_monitor.html">Traffic Monitor Administration</a></li>
<li class="toctree-l2 current"><a class="current reference internal" href="#">Traffic Router Administration</a></li>
<li class="toctree-l2"><a class="reference internal" href="traffic_stats.html">Traffic Stats Administration</a></li>
<li class="toctree-l2"><a class="reference internal" href="traffic_server.html">Traffic Server Administration</a></li>
<li class="toctree-l2"><a class="reference internal" href="traffic_vault.html">Traffic Vault Administration</a></li>
<li class="toctree-l2"><a class="reference internal" href="quick_howto/index.html">Quick How To Guides</a></li>
</ul>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../development/index.html">Developer&#8217;s Guide</a><ul>
<li class="toctree-l2"><a class="reference internal" href="../development/traffic_ops.html">Traffic Ops</a></li>
<li class="toctree-l2"><a class="reference internal" href="../development/traffic_portal.html">Traffic Portal</a></li>
<li class="toctree-l2"><a class="reference internal" href="../development/traffic_router.html">Traffic Router</a></li>
<li class="toctree-l2"><a class="reference internal" href="../development/traffic_monitor.html">Traffic Monitor</a></li>
<li class="toctree-l2"><a class="reference internal" href="../development/traffic_stats.html">Traffic Stats</a></li>
<li class="toctree-l2"><a class="reference internal" href="../development/traffic_server.html">Traffic Server</a></li>
</ul>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../faq/index.html">FAQ</a><ul>
<li class="toctree-l2"><a class="reference internal" href="../faq/general.html">General</a></li>
<li class="toctree-l2"><a class="reference internal" href="../faq/development.html">Development</a></li>
<li class="toctree-l2"><a class="reference internal" href="../faq/administration.html">Running a Traffic Control CDN</a></li>
</ul>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../glossary.html">Glossary</a></li>
</ul>
</div>
&nbsp;
</nav>
<section data-toggle="wy-nav-shift" class="wy-nav-content-wrap">
<nav class="wy-nav-top" role="navigation" aria-label="top navigation">
<i data-toggle="wy-nav-top" class="fa fa-bars"></i>
<a href="../index.html">Traffic Control</a>
</nav>
<div class="wy-nav-content">
<div class="rst-content">
<div role="navigation" aria-label="breadcrumbs navigation">
<ul class="wy-breadcrumbs">
<li><a href="../index.html">Traffic Control 1.7</a> &raquo;</li>
<li><a href="index.html">Administrator&#8217;s Guide</a> &raquo;</li>
<li>Traffic Router Administration</li>
<li class="wy-breadcrumbs-aside">
<a href="../_sources/admin/traffic_router.txt" rel="nofollow"> View page source</a>
</li>
</ul>
<hr/>
</div>
<div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
<a href="traffic_stats.html" class="btn btn-neutral float-right" title="Traffic Stats Administration">Next <span class="fa fa-arrow-circle-right"></span></a>
<a href="traffic_monitor.html" class="btn btn-neutral" title="Traffic Monitor Administration"><span class="fa fa-arrow-circle-left"></span> Previous</a>
</div>
<div role="main" class="document">
<div class="section" id="traffic-router-administration">
<h1><a class="toc-backref" href="#contents">Traffic Router Administration</a><a class="headerlink" href="#traffic-router-administration" title="Permalink to this headline"></a></h1>
<div class="contents topic" id="contents">
<p class="topic-title first">Contents</p>
<ul class="simple">
<li><a class="reference internal" href="#traffic-router-administration" id="id4">Traffic Router Administration</a><ul>
<li><a class="reference internal" href="#installing-traffic-router" id="id5">Installing Traffic Router</a></li>
<li><a class="reference internal" href="#configuring-traffic-router" id="id6">Configuring Traffic Router</a></li>
<li><a class="reference internal" href="#dnssec" id="id7">DNSSEC</a></li>
<li><a class="reference internal" href="#troubleshooting-and-log-files" id="id8">Troubleshooting and log files</a></li>
<li><a class="reference internal" href="#event-log-file-format" id="id9">Event Log File Format</a></li>
<li><a class="reference internal" href="#geolimit-failure-redirect-feature" id="id10">GeoLimit Failure Redirect feature</a></li>
<li><a class="reference internal" href="#steering-feature" id="id11">Steering feature</a></li>
<li><a class="reference internal" href="#https-for-http-type-delivery-services" id="id12">HTTPS for Http Type Delivery Services</a></li>
</ul>
</li>
</ul>
</div>
<div class="section" id="installing-traffic-router">
<h2><a class="toc-backref" href="#contents">Installing Traffic Router</a><a class="headerlink" href="#installing-traffic-router" title="Permalink to this headline"></a></h2>
<p>The following are requirements to ensure an accurate set up:</p>
<ul class="simple">
<li>CentOS 6</li>
<li>4 vCPUs</li>
<li>8GB RAM</li>
<li>Successful install of Traffic Ops</li>
<li>Successful install of Traffic Monitor</li>
<li>Administrative access to Traffic Ops</li>
</ul>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">Hardware requirements are generally doubled if DNSSEC is enabled</p>
</div>
<ol class="arabic">
<li><p class="first">If no suitable profile exists, create a new profile for Traffic Router.</p>
</li>
<li><p class="first">Enter the Traffic Router server into Traffic Ops, assign it to a Traffic Router profile, and ensure that its status is set to <code class="docutils literal"><span class="pre">ONLINE</span></code>.</p>
</li>
<li><p class="first">Ensure the FQDN of the Traffic Monitor is resolvable in DNS. This FQDN must be resolvable by the clients expected to use this CDN.</p>
</li>
<li><p class="first">Install a traffic router: <code class="docutils literal"><span class="pre">sudo</span> <span class="pre">yum</span> <span class="pre">install</span> <span class="pre">traffic_router</span></code>.</p>
</li>
<li><dl class="first docutils">
<dt>Edit <code class="docutils literal"><span class="pre">/opt/traffic_router/conf/traffic_monitor.properties</span></code> and specify the correct online Traffic Monitor(s) for your CDN. See <a class="reference internal" href="#rl-tr-config-files"><span class="std std-ref">Configuration files</span></a></dt>
<dd><p class="first"># traffic_monitor.properties: url that should normally point to this file
traffic_monitor.properties=file:/opt/traffic_router/conf/traffic_monitor.properties</p>
<p class="last"># Frequency for reloading this file
# traffic_monitor.properties.reload.period=60000</p>
</dd>
</dl>
</li>
<li><p class="first">Start Tomcat: <code class="docutils literal"><span class="pre">sudo</span> <span class="pre">service</span> <span class="pre">tomcat</span> <span class="pre">start</span></code>, and test lookups with dig and curl against that server.</p>
</li>
<li><p class="first">Snapshot CRConfig; See <a class="reference internal" href="traffic_ops_using.html#rl-snapshot-crconfig"><span class="std std-ref">Snapshot CRConfig</span></a></p>
</li>
</ol>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">Once the CRConfig is snapshotted, live traffic will be sent to the new Traffic Routers provided that their status is set to <code class="docutils literal"><span class="pre">ONLINE</span></code>.</p>
</div>
<ol class="arabic simple" start="8">
<li>Ensure that the parent domain (e.g.: kabletown.net) for the CDN&#8217;s top level domain (e.g.: cdn.kabletown.net) contains a delegation (NS records) for the new Traffic Router, and that the value specified matches the FQDN used in step 3.</li>
</ol>
</div>
<div class="section" id="configuring-traffic-router">
<h2><a class="toc-backref" href="#contents">Configuring Traffic Router</a><a class="headerlink" href="#configuring-traffic-router" title="Permalink to this headline"></a></h2>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">Starting with Traffic Router 1.5, many of the configuration files under <code class="docutils literal"><span class="pre">/opt/traffic_router/conf</span></code> are only needed to override the default configuration values for Traffic Router. Most of the given default values will work well for any CDN. Critical values that must be changed are hostnames and credentials for communicating with other Traffic Control components such as Traffic Ops and Traffic Monitor.</p>
</div>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">Pre-existing installations having configuration files in <code class="docutils literal"><span class="pre">/opt/traffic_router/conf</span></code> will still be used and honored for Traffic Router 1.5 and onward.</p>
</div>
<p>For the most part, the configuration files and parameters that follow are used to get Traffic Router online and communicating with various Traffic Control components. Once Traffic Router is successfully communicating with Traffic Control, configuration is mostly performed in Traffic Ops, and is distributed throughout Traffic Control via the CRConfig snapshot process. See <a class="reference internal" href="traffic_ops_using.html#rl-snapshot-crconfig"><span class="std std-ref">Snapshot CRConfig</span></a> for more information. Please see the parameter documentation for Traffic Router in the Using Traffic Ops guide documented under <a class="reference internal" href="traffic_ops_using.html#rl-ccr-profile"><span class="std std-ref">CCR Profile or Traffic Router Profile</span></a> for parameters that influence the behavior of Traffic Router via the CRConfig.</p>
<div class="section" id="configuration-files">
<span id="rl-tr-config-files"></span><h3>Configuration files<a class="headerlink" href="#configuration-files" title="Permalink to this headline"></a></h3>
<table border="1" class="docutils">
<colgroup>
<col width="13%" />
<col width="19%" />
<col width="45%" />
<col width="23%" />
</colgroup>
<thead valign="bottom">
<tr class="row-odd"><th class="head">File name</th>
<th class="head">Parameter</th>
<th class="head">Description</th>
<th class="head">Default Value</th>
</tr>
</thead>
<tbody valign="top">
<tr class="row-even"><td rowspan="4">traffic_monitor.properties</td>
<td>traffic_monitor.bootstrap.hosts</td>
<td>Traffic Monitor FQDNs and port if necessary, separated by a semicolon (;)</td>
<td>N/A</td>
</tr>
<tr class="row-odd"><td>traffic_monitor.bootstrap.local</td>
<td>Use only the Traffic Monitors specified in config file</td>
<td>false</td>
</tr>
<tr class="row-even"><td>traffic_monitor.properties</td>
<td>Path to the traffic_monitor.properties file; used internally to monitor the file for changes</td>
<td>/opt/traffic_router/traffic_monitor.properties</td>
</tr>
<tr class="row-odd"><td>traffic_monitor.properties.reload.period</td>
<td>The interval in milliseconds which Traffic Router will reload this configuration file</td>
<td>60000</td>
</tr>
<tr class="row-even"><td rowspan="6">dns.properties</td>
<td>dns.tcp.port</td>
<td>TCP port that Traffic Router will use for incoming DNS requests</td>
<td>53</td>
</tr>
<tr class="row-odd"><td>dns.tcp.backlog</td>
<td>Maximum length of the queue for incoming TCP connection requests</td>
<td>0</td>
</tr>
<tr class="row-even"><td>dns.udp.port</td>
<td>UDP port that Traffic Router will use for incoming DNS requests</td>
<td>53</td>
</tr>
<tr class="row-odd"><td>dns.max-threads</td>
<td>Maximum number of threads used to process incoming DNS requests</td>
<td>1000</td>
</tr>
<tr class="row-even"><td>dns.zones.dir</td>
<td>Path to auto generated zone files for reference</td>
<td>/opt/traffic_router/var/auto-zones</td>
</tr>
<tr class="row-odd"><td>dns.routing.name</td>
<td>The label (A/AAAA) Traffic Router will use for the entry point for a DNS delivery service</td>
<td>edge (e.g.: edge.mydeliveryservice.kabletown.net)</td>
</tr>
<tr class="row-even"><td rowspan="2">traffic_ops.properties</td>
<td>traffic_ops.username</td>
<td>Username to access the APIs in Traffic Ops (must be in the admin role)</td>
<td>admin</td>
</tr>
<tr class="row-odd"><td>traffic_ops.password</td>
<td>Password for the user specified in traffic_ops.username</td>
<td>N/A</td>
</tr>
<tr class="row-even"><td>http.properties</td>
<td>http.routing.name</td>
<td>The label (A/AAAA) Traffic Router will use for the entry point for an HTTP delivery service</td>
<td>tr (e.g.: tr.mydeliveryservice.kabletown.net)</td>
</tr>
<tr class="row-odd"><td rowspan="8">cache.properties</td>
<td>cache.geolocation.database</td>
<td>Full path to the local copy of the MaxMind geolocation binary database file</td>
<td>/opt/traffic_router/db/GeoIP2-City.mmdb</td>
</tr>
<tr class="row-even"><td>cache.geolocation.database.refresh.period</td>
<td>The interval in milliseconds which Traffic Router will poll for a new geolocation database</td>
<td>604800000</td>
</tr>
<tr class="row-odd"><td>cache.czmap.database</td>
<td>Full path to the local copy of the coverage zone file</td>
<td>/opt/traffic_router/db/czmap.json</td>
</tr>
<tr class="row-even"><td>cache.czmap.database.refresh.period</td>
<td>The interval in milliseconds which Traffic Router will poll for a new coverage zone file</td>
<td>10800000</td>
</tr>
<tr class="row-odd"><td>cache.health.json</td>
<td>Full path to the local copy of the health state</td>
<td>/opt/traffic_router/db/health.json</td>
</tr>
<tr class="row-even"><td>cache.health.json.refresh.period</td>
<td>The interval in milliseconds which Traffic Router will poll for a new health state file</td>
<td>1000</td>
</tr>
<tr class="row-odd"><td>cache.config.json</td>
<td>Full path to the local copy of the CRConfig</td>
<td>/opt/traffic_router/db/cr-config.json</td>
</tr>
<tr class="row-even"><td>cache.config.json.refresh.period</td>
<td>The interval in milliseconds which Traffic Router will poll for a new CRConfig</td>
<td>60000</td>
</tr>
<tr class="row-odd"><td>log4j.properties</td>
<td>various parameters</td>
<td>Configuration of log4j is documented on their site; adjust as necessary based on needs</td>
<td>N/A</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="section" id="dnssec">
<span id="rl-tr-dnssec"></span><h2><a class="toc-backref" href="#contents">DNSSEC</a><a class="headerlink" href="#dnssec" title="Permalink to this headline"></a></h2>
<div class="section" id="overview">
<h3>Overview<a class="headerlink" href="#overview" title="Permalink to this headline"></a></h3>
<p>Domain Name System Security Extensions (DNSSEC) is a set of extensions to DNS that provides a cryptographic mechanism for resolvers to verify the authenticity of responses served by an authoritative DNS server.</p>
<p>Several RFCs (4033, 4044, 4045) describe the low level details and define the extensions, RFC 7129 provides clarification around authenticated denial of existence of records, and finally RFC 6781 describes operational best practices for administering an authoritative DNSSEC enabled DNS server. The authenticated denial of existence RFC describes how an authoritative DNS server responds in NXDOMAIN and NODATA scenarios when DNSSEC is enabled.</p>
<p>Traffic Router currently supports DNSSEC with NSEC, however, NSEC3 and more configurable options will be provided in the future.</p>
</div>
<div class="section" id="operation">
<h3>Operation<a class="headerlink" href="#operation" title="Permalink to this headline"></a></h3>
<p>Upon startup or a configuration change, Traffic Router obtains keys from the keystore API in Traffic Ops which returns key signing keys (KSK) and zone signing keys (ZSK) for each delivery service that is a subdomain off the CDN&#8217;s top level domain (TLD), in addition to the keys for the CDN TLD itself. Each key has timing information that allows Traffic Router to determine key validity (expiration, inception, and effective dates) in addition to the appropriate TTL to use for the DNSKEY record(s). All TTLs are configurable parameters; see the <a class="reference internal" href="traffic_ops_using.html#rl-ccr-profile"><span class="std std-ref">CCR Profile or Traffic Router Profile</span></a> documentation for more information.</p>
<p>Once Traffic Router obtains the key data from the API, it converts each public key into the appropriate record types (DNSKEY, DS) to place in zones and uses the private key to sign zones. DNSKEY records are added to each delivery service&#8217;s zone (e.g.: mydeliveryservice.cdn.kabletown.net) for every valid key that exists, in addition to the CDN TLD&#8217;s zone. A DS record is generated from each zone&#8217;s KSK and is placed in the CDN TLD&#8217;s zone (e.g.: cdn.kabletown.net); the DS record for the CDN TLD must be placed in its parent zone, which is not managed by Traffic Control.</p>
<p>The DNSKEY to DS record relationship allows resolvers to validate signatures across zone delegation points; with Traffic Control, we control all delegation points below the CDN&#8217;s TLD, <strong>however, the DS record for the CDN TLD must be placed in the parent zone (e.g.: kabletown.net), which is not managed by Traffic Control</strong>. As such, the DS record (available in the Traffic Ops DNSSEC administration UI) must be placed in the parent zone prior to enabling DNSSEC, and prior to generating a new CDN KSK. Based on your deployment&#8217;s DNS configuration, this might be a manual process or it might be automated; either way, extreme care and diligence must be taken and knowledge of the management of the upstream zone is imperative for a successful DNSSEC deployment.</p>
</div>
<div class="section" id="rolling-zone-signing-keys">
<h3>Rolling Zone Signing Keys<a class="headerlink" href="#rolling-zone-signing-keys" title="Permalink to this headline"></a></h3>
<p>Traffic Router currently follows the zone signing key pre-publishing operational best practice described in <a class="reference external" href="https://tools.ietf.org/html/rfc6781#section-4.1.1.1">section 4.1.1.1 of RFC 6781</a>. Once DNSSEC is enabled for a CDN in Traffic Ops, key rolls are triggered via Traffic Ops via the automated key generation process, and Traffic Router selects the active zone signing keys based on the expiration information returned from the keystore API in Traffic Ops.</p>
</div>
</div>
<div class="section" id="troubleshooting-and-log-files">
<h2><a class="toc-backref" href="#contents">Troubleshooting and log files</a><a class="headerlink" href="#troubleshooting-and-log-files" title="Permalink to this headline"></a></h2>
<p>Traffic Router log files are in <code class="docutils literal"><span class="pre">/opt/traffic_router/var/log</span></code>, and Tomcat log files are in <code class="docutils literal"><span class="pre">/opt/tomcat/logs</span></code>. Application related logging is in <code class="docutils literal"><span class="pre">/opt/traffic_router/var/log/traffic_router.log</span></code>, while access logs are written to <code class="docutils literal"><span class="pre">/opt/traffic_router/var/log/access.log</span></code>.</p>
</div>
<div class="section" id="event-log-file-format">
<h2><a class="toc-backref" href="#contents">Event Log File Format</a><a class="headerlink" href="#event-log-file-format" title="Permalink to this headline"></a></h2>
<div class="section" id="summary">
<h3>Summary<a class="headerlink" href="#summary" title="Permalink to this headline"></a></h3>
<p>All access events to Traffic Router are logged to the file <code class="docutils literal"><span class="pre">/opt/traffic_router/var/log/access.log</span></code>
This file grows up to 200Mb and gets rolled into older log files, 10 log files total are kept (total of up to 2Gb of logged events per traffic router)</p>
<p>Traffic Router logs access events in a format that largely following <a class="reference external" href="https://docs.trafficserver.apache.org/en/6.0.x/admin/event-logging-formats.en.html">ATS event logging format</a></p>
</div>
<hr class="docutils" />
<div class="section" id="sample-message">
<h3>Sample Message<a class="headerlink" href="#sample-message" title="Permalink to this headline"></a></h3>
<p>Items within brackets below are detailed under the HTTP and DNS sections</p>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="mf">144140678.000</span> <span class="n">qtype</span><span class="o">=</span><span class="n">DNS</span> <span class="n">chi</span><span class="o">=</span><span class="mf">192.168</span><span class="o">.</span><span class="mf">10.11</span> <span class="n">ttms</span><span class="o">=</span><span class="mi">789</span> <span class="p">[</span><span class="n">Fields</span> <span class="n">Specific</span> <span class="n">to</span> <span class="n">the</span> <span class="n">DNS</span> <span class="n">request</span><span class="p">]</span> <span class="n">rtype</span><span class="o">=</span><span class="n">CZ</span> <span class="n">rloc</span><span class="o">=</span><span class="s2">&quot;40.252611,58.439389&quot;</span> <span class="n">rdtl</span><span class="o">=-</span> <span class="n">rerr</span><span class="o">=</span><span class="s2">&quot;-&quot;</span> <span class="p">[</span><span class="n">Fields</span> <span class="n">Specific</span> <span class="n">to</span> <span class="n">the</span> <span class="n">DNS</span> <span class="n">result</span><span class="p">]</span>
<span class="mf">144140678.000</span> <span class="n">qtype</span><span class="o">=</span><span class="n">HTTP</span> <span class="n">chi</span><span class="o">=</span><span class="mf">192.168</span><span class="o">.</span><span class="mf">10.11</span> <span class="n">ttms</span><span class="o">=</span><span class="mi">789</span> <span class="p">[</span><span class="n">Fields</span> <span class="n">Specific</span> <span class="n">to</span> <span class="n">the</span> <span class="n">HTTP</span> <span class="n">request</span><span class="p">]</span> <span class="n">rtype</span><span class="o">=</span><span class="n">GEO</span> <span class="n">rloc</span><span class="o">=</span><span class="s2">&quot;40.252611,58.439389&quot;</span> <span class="n">rdtl</span><span class="o">=-</span> <span class="n">rerr</span><span class="o">=</span><span class="s2">&quot;-&quot;</span> <span class="p">[</span><span class="n">Fields</span> <span class="n">Specific</span> <span class="n">to</span> <span class="n">the</span> <span class="n">HTTP</span> <span class="n">result</span><span class="p">]</span>
</pre></div>
</div>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">The above message samples contain fields that are always present for every single access event to Traffic Router</p>
</div>
<p><strong>Message Format</strong>
- Each event that is logged is a series of space separated key value pairs except for the first item.
- The first item is always the epoch in seconds with a decimal field precision of up to milliseconds
- Each key value pair is in the form of unquoted string, equals character, optionally quoted string
- Values that are quoted strings may contain space characters
- Values that are not quoted should not contains any space characters</p>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">Any value that is a single dash character or a dash character enclosed in quotes represents an empty value</p>
</div>
</div>
<hr class="docutils" />
<div class="section" id="fields-always-present">
<h3>Fields Always Present<a class="headerlink" href="#fields-always-present" title="Permalink to this headline"></a></h3>
<table border="1" class="docutils">
<colgroup>
<col width="4%" />
<col width="50%" />
<col width="46%" />
</colgroup>
<thead valign="bottom">
<tr class="row-odd"><th class="head">Name</th>
<th class="head">Description</th>
<th class="head">Data</th>
</tr>
</thead>
<tbody valign="top">
<tr class="row-even"><td>qtype</td>
<td>Whether the request was for DNS or HTTP</td>
<td>Always DNS or HTTP</td>
</tr>
<tr class="row-odd"><td>chi</td>
<td>The IP address of the requester</td>
<td>Depends on whether this was a DNS or HTTP request, see below sections</td>
</tr>
<tr class="row-even"><td>ttms</td>
<td>The amount of time in milliseconds it took Traffic Router to process the request</td>
<td>A number greater than or equal to zero</td>
</tr>
<tr class="row-odd"><td>rtype</td>
<td>Routing Result Type</td>
<td>One of ERROR, CZ, GEO, MISS, STATIC_ROUTE, DS_REDIRECT, DS_MISS, INIT, FED</td>
</tr>
<tr class="row-even"><td>rloc</td>
<td>GeoLocation of result</td>
<td>Latitude and Longitude in Decimal Degrees</td>
</tr>
<tr class="row-odd"><td>rdtl</td>
<td>Result Details Associated with unusual conditions</td>
<td>One of DS_NOT_FOUND, DS_NO_BYPASS, DS_BYPASS, DS_CZ_ONLY</td>
</tr>
<tr class="row-even"><td>rerr</td>
<td>Message about internal Traffic Router Error</td>
<td>String</td>
</tr>
</tbody>
</table>
<p><strong>rtype meanings</strong></p>
<table border="1" class="docutils">
<colgroup>
<col width="7%" />
<col width="93%" />
</colgroup>
<thead valign="bottom">
<tr class="row-odd"><th class="head">Name</th>
<th class="head">Meaning</th>
</tr>
</thead>
<tbody valign="top">
<tr class="row-even"><td>ERROR</td>
<td>An internal error occurred within Traffic Router, more details may be found in the rerr field</td>
</tr>
<tr class="row-odd"><td>CZ</td>
<td>The result was derived from Coverage Zone data based on the address in the chi field</td>
</tr>
<tr class="row-even"><td>GEO</td>
<td>The result was derived from geolocation service based on the address in the chi field</td>
</tr>
<tr class="row-odd"><td>MISS</td>
<td>Traffic Router was unable to resolve a DNS request or find a cache for the requested resource</td>
</tr>
<tr class="row-even"><td>STATIC_ROUTE</td>
<td>_*DNS Only*_ No DNS Delivery Service supports the hostname portion of the requested url</td>
</tr>
<tr class="row-odd"><td>DS_MISS</td>
<td>_*HTTP Only*_ No HTTP Delivery Service supports either this request&#8217;s URL path or headers</td>
</tr>
<tr class="row-even"><td>DS_REDIRECT</td>
<td>The result is using the Bypass Destination configured for the matched Delivery Service when that Delivery Service is unavailable or does not have the requested resource</td>
</tr>
<tr class="row-odd"><td>FED</td>
<td>_*DNS Only*_ The result was obtained through federated coverage zone data outside of any delivery service</td>
</tr>
</tbody>
</table>
<p><strong>rdtl meanings</strong></p>
<table border="1" class="docutils">
<colgroup>
<col width="16%" />
<col width="84%" />
</colgroup>
<thead valign="bottom">
<tr class="row-odd"><th class="head">Name</th>
<th class="head">Meaning</th>
</tr>
</thead>
<tbody valign="top">
<tr class="row-even"><td>DS_NOT_FOUND</td>
<td>Always goes with rtypes STATIC_ROUTE and DS_MISS</td>
</tr>
<tr class="row-odd"><td>DS_BYPASS</td>
<td>Used Bypass Destination for Redirect of Delivery Service</td>
</tr>
<tr class="row-even"><td>DS_NO_BYPASS</td>
<td>No valid Bypass Destination is configured for the matched Delivery Service and the delivery service does not have the requested resource</td>
</tr>
<tr class="row-odd"><td>DS_CZ_ONLY</td>
<td>The selected Delivery Service only supports resource lookup based on Coverage Zone data</td>
</tr>
<tr class="row-even"><td>DS_CLIENT_GEO_UNSUPPORTED</td>
<td>Traffic Router did not find a resource supported by coverage zone data and was unable to determine the geolocation of the requesting client</td>
</tr>
<tr class="row-odd"><td>GEO_NO_CACHE_FOUND</td>
<td>Traffic Router could not find a resource via geolocation data based on the requesting client&#8217;s geolocation</td>
</tr>
</tbody>
</table>
</div>
<hr class="docutils" />
<div class="section" id="http-specifics">
<h3>HTTP Specifics<a class="headerlink" href="#http-specifics" title="Permalink to this headline"></a></h3>
<p>Sample Message</p>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="mf">1452197640.936</span> <span class="n">qtype</span><span class="o">=</span><span class="n">HTTP</span> <span class="n">chi</span><span class="o">=</span><span class="mf">69.241</span><span class="o">.</span><span class="mf">53.218</span> <span class="n">url</span><span class="o">=</span><span class="s2">&quot;http://ccr.mm-test.jenkins.cdnlab.comcast.net/some/asset.m3u8&quot;</span> <span class="n">cqhm</span><span class="o">=</span><span class="n">GET</span> <span class="n">cqhv</span><span class="o">=</span><span class="n">HTTP</span><span class="o">/</span><span class="mf">1.1</span> <span class="n">rtype</span><span class="o">=</span><span class="n">GEO</span> <span class="n">rloc</span><span class="o">=</span><span class="s2">&quot;40.252611,58.439389&quot;</span> <span class="n">rdtl</span><span class="o">=-</span> <span class="n">rerr</span><span class="o">=</span><span class="s2">&quot;-&quot;</span> <span class="n">pssc</span><span class="o">=</span><span class="mi">302</span> <span class="n">ttms</span><span class="o">=</span><span class="mi">0</span> <span class="n">rurl</span><span class="o">=</span><span class="s2">&quot;http://odol-atsec-sim-114.mm-test.jenkins.cdnlab.comcast.net:8090/some/asset.m3u8&quot;</span> <span class="n">rh</span><span class="o">=</span><span class="s2">&quot;Accept: */*&quot;</span> <span class="n">rh</span><span class="o">=</span><span class="s2">&quot;myheader: asdasdasdasfasg&quot;</span>
</pre></div>
</div>
<p><strong>Request Fields</strong></p>
<table border="1" class="docutils">
<colgroup>
<col width="3%" />
<col width="74%" />
<col width="23%" />
</colgroup>
<thead valign="bottom">
<tr class="row-odd"><th class="head">Name</th>
<th class="head">Description</th>
<th class="head">Data</th>
</tr>
</thead>
<tbody valign="top">
<tr class="row-even"><td>url</td>
<td>Requested URL with query string</td>
<td>String</td>
</tr>
<tr class="row-odd"><td>cqhm</td>
<td>Http Method</td>
<td>e.g GET, POST</td>
</tr>
<tr class="row-even"><td>cqhv</td>
<td>Http Protocol Version</td>
<td>e.g. HTTP/1.1</td>
</tr>
<tr class="row-odd"><td>rh</td>
<td>One or more of these key value pairs may exist in a logged event and are controlled by the configuration of the matched Delivery Service</td>
<td>Key value pair of the format &#8220;name: value&#8221;</td>
</tr>
</tbody>
</table>
<p><strong>Response Fields</strong></p>
<table border="1" class="docutils">
<colgroup>
<col width="7%" />
<col width="77%" />
<col width="16%" />
</colgroup>
<thead valign="bottom">
<tr class="row-odd"><th class="head">Name</th>
<th class="head">Description</th>
<th class="head">Data</th>
</tr>
</thead>
<tbody valign="top">
<tr class="row-even"><td>rurl</td>
<td>The resulting url of the resource requested by the client</td>
<td>A URL String</td>
</tr>
</tbody>
</table>
</div>
<hr class="docutils" />
<div class="section" id="dns-specifics">
<h3>DNS Specifics<a class="headerlink" href="#dns-specifics" title="Permalink to this headline"></a></h3>
<p>Sample Message</p>
<div class="highlight-default"><div class="highlight"><pre><span></span><span class="mf">144140678.000</span> <span class="n">qtype</span><span class="o">=</span><span class="n">DNS</span> <span class="n">chi</span><span class="o">=</span><span class="mf">192.168</span><span class="o">.</span><span class="mf">10.11</span> <span class="n">ttms</span><span class="o">=</span><span class="mi">123</span> <span class="n">xn</span><span class="o">=</span><span class="mi">65535</span> <span class="n">fqdn</span><span class="o">=</span><span class="n">www</span><span class="o">.</span><span class="n">example</span><span class="o">.</span><span class="n">com</span><span class="o">.</span> <span class="nb">type</span><span class="o">=</span><span class="n">A</span> <span class="n">class</span><span class="o">=</span><span class="n">IN</span> <span class="n">ttl</span><span class="o">=</span><span class="mi">12345</span> <span class="n">rcode</span><span class="o">=</span><span class="n">NOERROR</span> <span class="n">rtype</span><span class="o">=</span><span class="n">CZ</span> <span class="n">rloc</span><span class="o">=</span><span class="s2">&quot;40.252611,58.439389&quot;</span> <span class="n">rdtl</span><span class="o">=-</span> <span class="n">rerr</span><span class="o">=</span><span class="s2">&quot;-&quot;</span> <span class="n">ans</span><span class="o">=</span><span class="s2">&quot;192.168.1.2 192.168.3.4 0:0:0:0:0:ffff:c0a8:102 0:0:0:0:0:ffff:c0a8:304&quot;</span>
</pre></div>
</div>
<p><strong>Request Fields</strong></p>
<table border="1" class="docutils">
<colgroup>
<col width="5%" />
<col width="52%" />
<col width="44%" />
</colgroup>
<thead valign="bottom">
<tr class="row-odd"><th class="head">Name</th>
<th class="head">Description</th>
<th class="head">Data</th>
</tr>
</thead>
<tbody valign="top">
<tr class="row-even"><td>xn</td>
<td>The ID from the client DNS request header</td>
<td>a number from 0 to 65535</td>
</tr>
<tr class="row-odd"><td>fqdn</td>
<td>The qname field from the client DNS request message (i.e. The
fully qualified domain name the client is requesting be resolved)</td>
<td>A series of DNS labels/domains separated by &#8216;.&#8217;
characters and ending with a &#8216;.&#8217; character (see <a class="reference external" href="http://www.zytrax.com/books/dns/ch15/#qname">qname</a>)</td>
</tr>
<tr class="row-even"><td>type</td>
<td>The qtype field from the client DNS request message (i.e.
the type of resolution that&#8217;s requested such as IPv4, IPv6)</td>
<td><dl class="first last docutils">
<dt>Examples are A (IpV4), AAAA (IpV6), NS (Name Service),</dt>
<dd>SOA (Start of Authority), and CNAME, (see <a class="reference external" href="http://www.zytrax.com/books/dns/ch15/#qtype">qtype</a>)</dd>
</dl>
</td>
</tr>
<tr class="row-odd"><td>class</td>
<td>The qclass field from the client DNS request message (i.e. The
class of resource being requested)</td>
<td><dl class="first last docutils">
<dt>Either IN (Internet resource) or ANY (Traffic router</dt>
<dd>rejects requests with any other value of class)</dd>
</dl>
</td>
</tr>
</tbody>
</table>
<p><strong>Response Fields</strong></p>
<table border="1" class="docutils">
<colgroup>
<col width="5%" />
<col width="54%" />
<col width="41%" />
</colgroup>
<thead valign="bottom">
<tr class="row-odd"><th class="head">Name</th>
<th class="head">Description</th>
<th class="head">Data</th>
</tr>
</thead>
<tbody valign="top">
<tr class="row-even"><td>ttl</td>
<td>The &#8216;time to live&#8217; in seconds for the answer provided by Traffic
Router (clients can reliably use this answer for this long without
re-querying traffic router)</td>
<td>A number from 0 to 4294967295</td>
</tr>
<tr class="row-odd"><td>rcode</td>
<td>The result code for the DNS answer provided by Traffic Router</td>
<td>One of NOERROR (success), NOTIMP (request is not
NOTIMP (request is not supported),
REFUSED (request is refused to be answered), or
NXDOMAIN (the domain/name requested does not exist)</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="section" id="geolimit-failure-redirect-feature">
<span id="rl-tr-ngb"></span><h2><a class="toc-backref" href="#contents">GeoLimit Failure Redirect feature</a><a class="headerlink" href="#geolimit-failure-redirect-feature" title="Permalink to this headline"></a></h2>
<div class="section" id="id1">
<h3>Overview<a class="headerlink" href="#id1" title="Permalink to this headline"></a></h3>
<p>This feature is also called &#8216;National GeoBlock&#8217; feature which is short for &#8216;NGB&#8217; feature. In this section, the acronym &#8216;NGB&#8217; will be used for this feature.</p>
<p>In the past, if the Geolimit check fails (for example, the client ip is not in the &#8216;US&#8217; region but the geolimit is set to &#8216;CZF + US&#8217;), the router will return 503 response; but with this feature, when the check fails, it will return 302 if the redirect url is set in the delivery service.</p>
<p>The Geolimit check failure has such scenarios:
1) When the GeoLimit is set to &#8216;CZF + only&#8217;, if the client ip is not in the the CZ file, the check fails
2) When the GeoLimit is set to any region, like &#8216;CZF + US&#8217;, if the client ip is not in such region, and the client ip is not in the CZ file, the check fails</p>
</div>
<div class="section" id="configuration">
<h3>Configuration<a class="headerlink" href="#configuration" title="Permalink to this headline"></a></h3>
<p>To enable the NGB feature, the DS must be configured with the proper redirect url. And the setting lays at &#8216;Delivery Services&#8217;-&gt;Edit-&gt;&#8217;GeoLimit Redirect URL&#8217;. If no url is put in this field, the feature is disabled.</p>
<p>The URL has 3 kinds of formats, which have different meanings:</p>
<ol class="arabic simple">
<li>URL with no domain. If no domain is in the URL (like &#8216;vod/dance.mp4&#8217;), the router will try to find a proper cache server within the delivery service and return the redirect url with the format like &#8216;<a class="reference external" href="http:/">http:/</a>/&lt;cache server name&gt;.&lt;delivery service&#8217;s FQDN&gt;/&lt;configured relative path&gt;&#8217;</li>
<li>URL with domain that matches with the delivery service. For this URL, the router will also try to find a proper cache server within the delivery service and return the same format url as point 1.</li>
<li>URL with domain that doesn&#8217;t match with the delivery service. For this URL, the router will return the configured url directly to the client.</li>
</ol>
</div>
</div>
<div class="section" id="steering-feature">
<span id="rl-tr-steering"></span><h2><a class="toc-backref" href="#contents">Steering feature</a><a class="headerlink" href="#steering-feature" title="Permalink to this headline"></a></h2>
<div class="section" id="id2">
<h3>Overview<a class="headerlink" href="#id2" title="Permalink to this headline"></a></h3>
<p>A Steering delivery service is a delivery service that is used to &#8220;steer&#8221; traffic to other delivery services. A Steering delivery service will have target delivery services configured for it with weights assigned to them. Traffic Router uses the weights to make a consistent hash ring which it then uses to make sure that requests are routed to a target based on the configured weights. This consistent hash ring is separate from the consistent hash ring used in cache selection.</p>
<p>Special regular expressions called Filters can also be configured for target delivery services to pin traffic to a specific delivery service. For example, if a filter called .*/news/.* for a target called target-ds-1 is created, any requests to traffic router with &#8216;news&#8217; in them will be routed to target-ds-1. This will happen regardless of the configured weights.</p>
<p>A client can bypass the steering functionality by providing a header called X-TC-Steering-Option with the xml_id of the target delivery service to route to. When Traffic Router receives this header it will route to the requested target delivery service regardless of weight configuration.</p>
<p>Some other points of interest:
- Steering is currently only available for HTTP delivery services that are a part of the same CDN.
- A new role called STEERING has been added to the traffic ops database. Only users with Admin or Steering privileges can modify steering assignments for a Delivery Service.
- A new API has been created in Traffic Ops under /internal. This API is used by a Steering user to add filters and modify assignments. (Filters can only be added via the API).
- Traffic Router uses the steering API in Traffic Ops to poll for steering assignments, the assignments are then used when routing traffic.</p>
<p>A couple simple use cases for steering are:</p>
<ol class="arabic simple">
<li>Migrating traffic from one delivery service to another over time.</li>
<li>Trying out new functionality for a subset of traffic with an experimental delivery service.</li>
<li>Load balancing between delivery services.</li>
</ol>
</div>
<div class="section" id="id3">
<h3>Configuration<a class="headerlink" href="#id3" title="Permalink to this headline"></a></h3>
<p>The following needs to be completed for Steering to work correctly:</p>
<ol class="arabic simple">
<li>Two target delivery services are created in Traffic Ops. They must both be HTTP delivery services part of the same CDN.</li>
<li>A delivery service with type STEERING is created in Traffic Ops.</li>
<li>Target delivery services are assigned to the steering delivery service using Traffic Ops.</li>
<li>A user with the role of Steering is created.</li>
<li>Using the API, the steering user assigns weights to the target delivery services.</li>
<li>If desired, the steering user can create filters for the target delivery services.</li>
</ol>
<p>For more information see the <a class="reference external" href="quick_howto/steering.html">steering how-to guide</a>.</p>
</div>
</div>
<div class="section" id="https-for-http-type-delivery-services">
<h2><a class="toc-backref" href="#contents">HTTPS for Http Type Delivery Services</a><a class="headerlink" href="#https-for-http-type-delivery-services" title="Permalink to this headline"></a></h2>
<p>Starting with version 1.7 Traffic Router added the ability to allow https traffic between itself and clients on a per http type delivery service basis.</p>
<div class="admonition warning">
<p class="first admonition-title">Warning</p>
<p class="last">The establishing of an HTTPS connection is much more computationally demanding than an HTTP connection.
Since each client will in turn get redirected to ATS, Traffic Router is most always creating a new HTTPS connection for all HTTPS traffic.
It is likely to mean that an existing Traffic Router will have some decrease in performance depending on the amount of https traffic you want to support
As noted for DNSSEC, you may need to plan to scale Traffic Router vertically and/or horizontally to handle the new load</p>
</div>
<p>The summary for setting up https is to:</p>
<ol class="arabic simple">
<li>Select one of &#8216;https&#8217;, &#8216;http and https&#8217;, or &#8216;http to https&#8217; for the delivery service</li>
<li>Generate private keys for the delivery service using a wildcard domain such as <code class="docutils literal"><span class="pre">*.my-delivery-service.my-cdn.example.com</span></code></li>
<li>Obtain and import signed certificate chain</li>
<li>Snapshot CR Config</li>
</ol>
<p>Clients may make HTTPS requests delivery services only after Traffic Router receives the certificate chain from Traffic Ops and the new CR Config.</p>
<div class="section" id="protocol-options">
<h3>Protocol Options<a class="headerlink" href="#protocol-options" title="Permalink to this headline"></a></h3>
<dl class="docutils">
<dt><em>https only</em></dt>
<dd>Traffic Router will only redirect (send a 302) to clients communicating with a secure connection, all other clients will receive a 503</dd>
<dt><em>http and https</em></dt>
<dd>Traffic Router will redirect both secure and non-secure clients</dd>
<dt><em>http to https</em></dt>
<dd>Traffic Router will redirect non-secure clients with a 302 and a location that is secure (i.e. starting with &#8216;https&#8217; instead of &#8216;http&#8217;), secure clients will remain on https</dd>
<dt><em>http</em></dt>
<dd>Any secure client will get an SSL handshake error. Non-secure clients will experience the same behavior as prior to 1.7</dd>
</dl>
</div>
<div class="section" id="certificate-retrieval">
<h3>Certificate Retrieval<a class="headerlink" href="#certificate-retrieval" title="Permalink to this headline"></a></h3>
<div class="admonition warning">
<p class="first admonition-title">Warning</p>
<p class="last">If you have https delivery services in your CDN, Traffic Router will not accept <strong>any</strong> connections until it is able to
fetch certificates from Traffic Ops and load them into memory. Traffic Router does not persist certificates to the java keystore or anywhere else.</p>
</div>
<p>Traffic Router fetches certificates into memory:</p>
<ul class="simple">
<li>At startup time</li>
<li>When it receives a new CR Config</li>
<li>Once an hour from whenever the most recent of the last of the above occurred</li>
</ul>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">To adjust the frequency when Traffic Router fetches certificates add the parameter &#8216;certificates.polling.interval&#8217; to CR Config and
setting it to the desired time in milliseconds.</p>
</div>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">Taking a snapshot of CR Config may be used at times to avoid waiting the entire polling cycle for a new set of certificates.</p>
</div>
<div class="admonition warning">
<p class="first admonition-title">Warning</p>
<p class="last">If a snapshot of CR Config is made that involves a delivery service missing its certificates, Traffic Router will ignore <strong>ALL</strong> changes in that CR-Config
until one of the following occurs:
* It receives certificates for that delivery service
* Another snapshot of CR Config is created and the delivery service without certificates is changed so it&#8217;s HTTP protocol is set to &#8216;http&#8217;</p>
</div>
</div>
<div class="section" id="certificate-chain-ordering">
<h3>Certificate Chain Ordering<a class="headerlink" href="#certificate-chain-ordering" title="Permalink to this headline"></a></h3>
<p>The ordering of certificates within the certificate bundle matters. It must be:</p>
<ol class="arabic simple">
<li>Primary Certificate (e.g. the one created for <code class="docutils literal"><span class="pre">*.my-delivery-service.my-cdn.example.com</span></code>)</li>
<li>Intermediate Certificate(s)</li>
<li>Root Certificate from CA (optional)</li>
</ol>
<div class="admonition warning">
<p class="first admonition-title">Warning</p>
<p class="last">If something is wrong with the certificate chain (e.g. the order of the certificates is backwards or for the wrong domain) the
client will get an SSL handshake. Inspection of /opt/tomcat/logs/catalina.out is likely to yield information to reveal this.</p>
</div>
<p>To see the ordering of certificates you may have to manually split up your certificate chain and use openssl on each individual certificate</p>
</div>
<div class="section" id="suggested-way-of-setting-up-an-https-delivery-service">
<h3>Suggested Way of Setting up an HTTPS Delivery Service<a class="headerlink" href="#suggested-way-of-setting-up-an-https-delivery-service" title="Permalink to this headline"></a></h3>
<p>Do the following in Traffic Ops:</p>
<ol class="arabic simple">
<li>Select one of &#8216;https&#8217;, &#8216;http and https&#8217;, or &#8216;http to https&#8217; for the protocol field of a delivery service and click &#8216;Save&#8217;.</li>
<li>Click &#8216;Manage SSL Keys&#8217;.</li>
<li>Click &#8216;Generate New Keys&#8217;.</li>
<li>Copy the contents of the Certificate Signing Request field and save it locally.</li>
<li>Click &#8216;Load Keys&#8217;.</li>
<li>Select &#8216;http&#8217; for the protocol field of the delivery service and click &#8216;Save&#8217; (to avoid preventing other CR Config updates from being blocked by Traffic Router)</li>
<li>Follow your standard procedure for obtaining your signed certificate chain from a CA.</li>
<li>After receiving your certificate chain import it into Traffic Ops.</li>
<li>Edit the delivery service.</li>
<li>Restore your original choice for the protocol field and click save.</li>
<li>Click &#8216;Manage SSL Keys&#8217;.</li>
<li>Click &#8216;Paste Existing Keys&#8217;.</li>
<li>Paste the certificate chain into the CRT field.</li>
<li>Click &#8216;Load Keys&#8217;.</li>
<li>Take a new snapshot of CR Config.</li>
</ol>
<p>Once this is done you should be able to test you are getting correctly redirected by Traffic Router using curl commands to https destinations on your delivery service.</p>
<p>A new testing tool was created for load testing traffic router, it allows you to generate requests from your local box to multiple delivery services of a single cdn.
You can control which cdn, delivery services, how many transactions per delivery service, and how many concurrent requests.
During the test it will provide feedback about request latency and transactions per second.</p>
<p>While it is running it is suggested that you monitor your Traffic Router nodes for memory and CPU utilization.</p>
</div>
</div>
</div>
</div>
<footer>
<div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
<a href="traffic_stats.html" class="btn btn-neutral float-right" title="Traffic Stats Administration">Next <span class="fa fa-arrow-circle-right"></span></a>
<a href="traffic_monitor.html" class="btn btn-neutral" title="Traffic Monitor Administration"><span class="fa fa-arrow-circle-left"></span> Previous</a>
</div>
<hr/>
<div role="contentinfo">
<p>
</p>
</div>
Built with <a href="http://sphinx-doc.org/">Sphinx</a> using a <a href="https://github.com/snide/sphinx_rtd_theme">theme</a> provided by <a href="https://readthedocs.org">Read the Docs</a>.
</footer>
</div>
</div>
</section>
</div>
<script type="text/javascript">
var DOCUMENTATION_OPTIONS = {
URL_ROOT:'../',
VERSION:'1.7',
COLLAPSE_INDEX:false,
FILE_SUFFIX:'.html',
HAS_SOURCE: true
};
</script>
<script type="text/javascript" src="../_static/jquery.js"></script>
<script type="text/javascript" src="../_static/underscore.js"></script>
<script type="text/javascript" src="../_static/doctools.js"></script>
<script type="text/javascript" src="../_static/js/theme.js"></script>
<script type="text/javascript">
jQuery(function () {
SphinxRtdTheme.StickyNav.enable();
});
</script>
</body>
</html>