Local Cluster - Setup v2

Use the Flowgear Local Cluster Manager app to configure a Host with the Cluster's config.json, send its certificate to Flowgear, and start its Windows service. Then trust the certificate in the Flowgear Console so the Host can connect.

Prerequisites

  • The Flowgear local Cluster is installed.
  • The local Cluster is registered in the Flowgear Console.
  • You have administrator privileges on the machine.
  • To trust the certificate, you need permission to edit the local Cluster in the Flowgear Console.

Adding a Host to a Cluster that already has one? See Add a Host to an existing Cluster. The steps are different because every Host shares the Cluster's trusted certificate.

Step 1: Copy config.json

The Cluster's config.json contains the values the Host needs to connect: your Flowgear tenant Host name, the ClusterKey, and the SiteKey.

  1. Open the local Cluster in the Flowgear Console to view its detail page.
  2. In the Set up this Cluster section under Hosts, copy the config.json with its copy button. You can also download it as a file.

Tip: You can also download a Cluster's config.json from the Local Clusters explorer by selecting Download config.json in the Cluster's menu.

Step 2: Configure and start the Host

  1. On the Host machine, open Flowgear Local Cluster Manager from the Start menu, and allow it to make changes when Windows User Account Control prompts you.

  2. Under Configuration, paste the contents of config.json.

    The app checks the configuration as you type and shows its state: Certificate needed means the configuration is valid but the Host has no certificate yet, and Complete means the configuration and its certificate are ready.

  3. Click Configure & Start.

The app then:

  1. Creates a certificate in the Local Computer › Personal › Certificates store if the configuration does not name one yet, and adds its CertificateThumbprint to the configuration.
  2. Saves the configuration to config.json in the installation folder.
  3. Sends the certificate's public key to Flowgear as a candidate for an administrator to trust.
  4. Stops and starts the Flowgear Local Cluster Host service.

The Output panel shows the result. Certificate sent. An administrator can approve it in Console. confirms that the certificate was sent.

The Configuration box now shows the saved configuration, including the CertificateThumbprint. Copy this value for the next step.

Step 3: Trust the certificate

The Host cannot connect until its certificate is trusted.

  1. Open the local Cluster in the Flowgear Console to view its detail page.
  2. In the Certificate section, open Candidate certificates, and then click Refresh candidates if the certificate does not appear yet.
  3. Find the candidate whose thumbprint matches the CertificateThumbprint from the app. You can search by thumbprint or subject.
  4. Click Trust on that row.
  5. In the Trust certificate dialog, paste the CertificateThumbprint from the app. Trust is only available once the pasted value matches the candidate's thumbprint exactly.
  6. Click Trust.

The Certificate section now shows the trusted certificate's thumbprint.

Click Restart Service in the Flowgear Local Cluster Manager app so the Host connects with the trusted certificate.

About candidate certificates

  • A candidate expires 24 hours after it was last submitted. Expired candidates show Expired and cannot be trusted. Click Configure & Start again in the app to submit the certificate again.
  • A Cluster can hold up to five candidates, including expired ones. To make room, remove candidates you do not need, either one at a time or by selecting several and clicking Remove selected.
  • Candidates only appear while the Cluster has no trusted certificate.

Step 4: Verify the Host

  1. In the Flowgear Console, click the refresh button beside the Hosts heading on the local Cluster's detail page.
  2. Confirm that the Host appears and shows as online.

Note: The Service badge in the Flowgear Local Cluster Manager app shows the Windows service state only. A running service does not confirm that the Host has connected to Flowgear. Check the Host's status in the Flowgear Console.

Add a Host to an existing Cluster

Every Host in a Cluster uses the same trusted certificate, so there is no new certificate to trust. Copy the certificate, including its private key, from an existing Host to the new machine.

When the Cluster has Hosts and a trusted certificate, its detail page shows an Add a Host section under Hosts with these steps and the thumbprint to export.

  1. On a machine that already runs the Cluster, open certlm.msc and find the certificate with the trusted thumbprint in Local Computer › Personal › Certificates. Export it, including its private key, as a password-protected .pfx file.
  2. On the new machine, import the .pfx file into Local Computer › Personal › Certificates.
  3. Download and run the installer on the new machine.
  4. Copy the config.json from the Add a Host section, paste it into the Flowgear Local Cluster Manager app on the new machine, and then click Configure & Start.

The config.json already names the trusted certificate, and the new Host connects once the service starts.

Upload a certificate manually

If a Host cannot send its certificate from the Flowgear Local Cluster Manager app, you can upload the certificate's public key instead.

  1. Export the Host's certificate without its private key as a .cer file. The certificate is in Local Computer › Personal › Certificates; its thumbprint is the CertificateThumbprint in the Host's configuration.
  2. Open the local Cluster in the Flowgear Console.
  3. In the Certificate section, expand Upload a certificate manually, and then upload the .cer file.
  4. Click Restart Service in the Flowgear Local Cluster Manager app.

Do not upload a .pfx file or any file that contains the private key.

Remove the trusted certificate

Remove the trusted certificate when you need to replace it, for example after the certificate is compromised or a Host is rebuilt.

  1. Open the local Cluster in the Flowgear Console.
  2. In the Certificate section, click Remove certificate.
  3. Confirm the removal.

No Host in the Cluster can connect again until a new certificate is trusted. A connection that is already open can stay active until the service on that Host is restarted.

After removal, the Candidate certificates section appears again so you can trust a replacement certificate.

Troubleshooting

The certificate was not accepted

The Output panel shows this message when the Cluster already has a trusted certificate, or when it already holds five candidates. Remove the trusted certificate or unneeded candidates in the Flowgear Console, and then click Configure & Start again.

This Local Cluster could not be found

Check that you copied config.json from the correct Cluster in the Flowgear Console.

The server could not be reached

Check the Host value in the configuration and confirm that the machine has outbound access to port 443.

Too many attempts

The app limits how often it can send a certificate. Wait for the time shown, and then try again.

The service fails to start

Click Open Log Folder in the Flowgear Local Cluster Manager app to view the Host's log files. Also check Windows Event Viewer for details about the service failure.

The local Cluster does not come online

Confirm that the certificate is trusted and that its thumbprint matches the CertificateThumbprint in the Host's configuration. Then click Restart Service in the app and check the log files for errors.

See also