Your Browser is Out of Date

Nytro.ai uses technology that works best in other browsers.
For a full experience use one of the browsers below
Dell Validated Design for Manufacturing Edge - Design Guide with XMPro
Introduction Architecture System Design Accelerated Time to Value High Availability and Disaster Recovery Application Consolidation Cybersecurity Gateways Streaming Data Platform ISV Interoperability Sizing and Scaling Guidance Bill of Materials Additional Tasks
XMPro tasks
Additional Information References

XMPro tasks

Home > Edge > Manufacturing Edge > Guides > Dell Validated Design for Manufacturing Edge - Design Guide with XMPro > XMPro tasks

XMPro tasks


  • XMPro security tasks


    Create an SMTP server

    Using h-mail as third-party SMTP server, perform the following steps.

    1. Run through the installer, accept the defaults, and enter a password.
      Figure 104. Hmail Admin home window

      Hmail Admin home window

      Figure 105. Saving the domain name of your email server

      Saving the domain name of your email server

    2. Go to Accounts. Add two users and their passwords.
      Figure 106. Enter usernames and include password for each

      Enter usernames and include password for each

      Figure 107. Usernames and email status displayed in the Accounts tab

      Usernames and email status displayed in the Accounts tab


    Enable SSL/TLS for SMTP

    1. Go to SMTP server Settings > SSL Certificates.
      1. Click ADD to add a certificate.
      2. If you do not have them already, create three certificates (.key, .csr, and .crt) using OpenSSL or however you typically create certificates.
      3. Add the .crt to the Certificate File.
      4. Add the .key to the Private Key File.
        Figure 108. Input the Private key file and server certificate into Hmail
        Input the Private key file and server certificate into Hmail
      5. Click Save.
    2. Go to Hmail > Settings > Protocols > SMTP > Delivery of e-mail.
      1. Change Connection security to STARTTLS (optional) and change the port to 587.
        Figure 109. Configuration of Hmail to deliver email via TLS
        Configuration of Hmail to deliver email via TLS
    3. Go to Settings > Advanced > TCP/IP ports
      1. Add new connection security ports to SSL/TLS and add the SSL certificate.
      2. For SMTP, add 587.
      3. For POP3, add 995.
        Figure 110. Add new security ports to the default ones (POP3)
        Add new security ports to the default ones (POP3)
      4. Change 587 to STARTTLS (optional).
        Figure 111. Adding new security ports to the default ones (SMTP)
        Adding new security ports to the default ones (SMTP)
    4. Go into Thunderbird and change the SMTP server security to STARTTLS as well.
    5. Go to SM installer (upgrade if its already installed) and check the box for Enable SSL.
      1. Change port to 587.
        Figure 112. Configure SMTP settings on XMPro client
        Configure SMTP settings on XMPro client

    Use Mosquitto as an MQTT Broker

    Note: Mosquitto was installed on ubuntu 20.04

    1. Install Mosquitto and mosquitto-clients: 
      Sudo apt-get install mosquitto mosquitto-clients
      1. Open a new terminal tab and run the command to subscribe to the local broker: 
        mosquitto_sub -t "test" -h 127.0.0.1
      2. Open another terminal tab and run the command to publish locally: 
        mosquitto_pub -m "message" -t "test"
      3. Verify that the message was outputted to the subscription tab.
    2. Set username and password: 
      Sudo mosquitto_passwd -c /etc/mosquitto/passwd
      <username>
      1. Enter the password at the prompt.
    3. Edit the /etc/mosquitto/conf.d/default.conf file.
      1. Copy or enter in the following line: 
        allow_anonymous false
        password_file /etc/mosquito/passwd
      2. Save the changes.
      3. Duplicate edits to the /etc/mosquitto/mosquitto.conf file (this may be where your host is searching).
      4. Restart mosquito.
    4. In the Subscription tab: 
      mosquitto_sub -t "test" -u <username> -P <password>
      -h 127.0.0.1
      1. In the Publish tab: 
        mosquitto_pub -t "test" -m "message from mosquitto_pub "client"
        -u <username> -P <password>

    Enable SSL/TLS (Openssl with Easy-RSA)

    Helpful Links: Full Config guidelines (Skip Steps 2-4) and use Mosquitto SSL Configuration -MQTT TLS Security for inputting certificates. If you already have a root CA cert and a server certificate signed by that CA, use those as your certificates instead. Use Creating a Self-Signed Certificate to learn how to create your own CA and sign your own server certs via OpenSSL.

    1. In OpenSSL, the server certificate signed by the CA is easyrsa/pki/issued.
      1. Take it out of this location and change permissions.
    2. Once you have your server and root (CA) cert available, find the private key:
      1. Copy over CA certificate (which is the Easy-RSA CA in this example). Add the newly verified or signed server certificate and the private key from earlier to the MQTT host.
      2. Place the CA certificate under /etc/mosquitto/ca_certificates.
      3. Place the server certificate under /etc/mosquitto/certs.
      4. Place the private key under /etc/mosquitto/certs.
      5. Create a certs directory in /etc/mosquitto if one does not already exist.
    3. Edit the /etc/mosquitto/conf.d/default.conf file.
      1. Duplicate edits to the /etc/mosquitto/mosquitto.conf file.
    4. Add these lines to the conf file: 
      listener 1883
      listener 8883 
      allow_anonymous true
      password_file /etc/mosquitto/passwd 
      certfile /etc/mosquitto/certs/<server certificate>.crt
      keyfile /etc/mosquitto/certs/<private keyfile>.key
      cafile /etc/mosquitto/ca_certificates/<CA certificate>.crt
      Figure 113. Secure configuration file for MQTT Mosquitto example

      Secure configuration file for MQTT Mosquitto example

      1. Duplicate edits in mosquitto.conf.
    5. Restart mosquitto and make sure there are no errors
      1. If it fails to restart, it is most likely an error with the .conf files.

    Test MQTT over TLS/SSL

    1. Pub: First test by publishing a message.
    2. Getting a TLS Error at this stage is expected. 
      mosquitto_pub -h <FQDN/hostname used in certificate> -t
      <topic name> --cafile <full path to ca that is used for
      broker in config> -m “message” -p 8883 -u
      “<username>” -P “password”>
    3. Sub: Now that you know publishing messages over TLS is working, substitute with the following command and publish again on another terminal to confirm full functionality: 
      mosquitto_sub -h <FQDN/hostname used in certificate> -t
      <topic name> --cafile <full path to ca that is used for
      broker in config> -p 8883 -u “<username>” -P
      “<password>”
    4. Test MQTT locally with validating client certificates.
      1. The broker checks the client's certificate and makes sure it is ok to talk to this client (signed by a trusted CA).
    5. Transfer certificate files to the host where you access the XMPro web application.

    Troubleshooting tips


    Subscription Manager installation issues


    Issue 1: Error: https is not enabled

    During on-premise installation of Subscription manager, https is not enabled on the IIS manager by default.

    To fix this, enable https bindings to the IIS manager by performing the following steps.

    1. By default, http is selected in IIS Manager. Go to IIS Manager > Default Web Site > Bindings.
    2. Add https binding for the default website and xmprosubscriptionmanager.
    Figure 114. Site Bindings
    Site Bindings

    Issue 2: Server Error in '/xmprosubscriptionmanager' Application

    Specifically for self-signed certificates, the remote certificate is invalid according to the validation procedure.
    Add the cert to a trusted CA How to manage Trusted Root Certificates in Windows 11/10.
    Figure 115. Server Error in '/xmprosubscriptionmanager' Application
    Server Error in '/xmprosubscriptionmanager' Application

    Issue 3: Browser Error in '/xmprosubscriptionmanager' Application

    Some Browsers like Firefox may encounter this issue when using self-signed certificates. The following steps, detailed here, provide a solution.
    1. Enable Network.Stricttransportsecurity.Preloadlist.
    2. Clear the SSL State.
    3. Click Accept the Risk and Continue while ignoring the error.