SSL Overview¶
A map of every network connection MetaMiner makes in a Power BI installation, whether it uses TLS, and the page that configures it.
How it works¶
Each connection is encrypted separately. Turning on SSL for the MetaMiner Server (MMS) port covers every client and browser connection, because the MetaMiner Client (MMC), the usage dashboards and Meta Query on the web all use that one port. Connections to Microsoft always use HTTPS. The connection to the MetaMiner Database (MMDB) has its own setting.
flowchart LR
MMC[MetaMiner Client] -->|1 TLS| MMS[MetaMiner Server]
BR[Browser] -->|2 TLS| MMS
MMS -->|3 local only| WA[Web Apps service]
MMS -->|4 HTTPS| MS[Microsoft Entra ID, Power BI, Fabric, Graph]
MMC -->|5 HTTPS| ENTRA[Microsoft sign-in, Fabric, OneLake]
MMS -->|6 SSL| MMDB[(MetaMiner Database)]
RT[Reporting tools] -->|7 SSL| MMDB
MMS -->|8 LDAPS| DIR[LDAP or AD]
MMS -->|9 SSL| SMTP[Mail server]Connection map¶
| # | Connection | Default port | Encryption | Configure on |
|---|---|---|---|---|
| 1 | MMC to MMS | 49714 | TLS 1.2 or 1.3 when MMS SSL is on | MetaMiner Server SSL, then Client to Server SSL |
| 2 | Browser to MMS (/web/...) |
49714 | Same certificate as #1 | MetaMiner Server SSL |
| 3 | MMS to Web Apps service | 49717 | Does not leave the server host | Nothing to configure. Keep the port closed in the firewall (Network Exposure) |
| 4 | MMS to Microsoft Entra ID, Power BI, Fabric and Graph APIs | 443 | HTTPS, TLS 1.2 or 1.3, always on | Nothing to turn on. See Trusted Certificates |
| 5 | MMC to Microsoft sign-in, and to Fabric and OneLake for lakehouse export | 443 | HTTPS, always on | Nothing to turn on |
| 6 | MMS to MMDB | 49614 embedded, 5432 typical external | PostgreSQL SSL | MetaMiner Database SSL |
| 7 | ODBC or JDBC clients to MMDB | as #6 | PostgreSQL SSL, chosen by each client | MetaMiner Database SSL |
| 8 | MMS and MetaMiner Administrator to LDAP or Active Directory | 389 or 636 | LDAPS | Import Users from LDAP or AD |
| 9 | MMS to the mail server | Your SMTP port | SSL option in e-mail settings |
Recommended order¶
- Turn on MetaMiner Server SSL and distribute your CA to clients with Client to Server SSL.
- Turn on MetaMiner Database SSL when the database is remote or read over the network.
- Add LDAPS and SMTP SSL where your policies require them.
Certificates you need¶
| For | Certificate | Key format |
|---|---|---|
| MMS (#1, #2) | Server certificate for the MMS host names, from your CA | RSA private key, PEM, PKCS#8 |
| Clients of #1 | Your issuing CA certificate in the MMC trust store | - |
| MMDB (#6, #7) | Server certificate for the database host name | PEM certificate and key, as PostgreSQL requires |
| Microsoft endpoints (#4, #5) | None. Microsoft certificates chain to public CAs | - |
| Directory (#8) | The CA of the directory certificate, trusted on the MMS host | - |