RavenDb 4 Part 1 - Installation

This article is intended for those setting up RavenDb in a secured (non-developer) environment using x509 certificates for mutual authentication.

A diagram of the architecture for the purposes of this discussion is shown below.

Please note that RavenDb4 recommends a minimum of 3 nodes in a cluster however we'll use 2 and demonstrate some issues you might encounter.

Generate wildcard certificates

If you have an existing certificate (signed by CA or other) then you can skip this step.

Start administrator powershell prompt

curl.exe -LJO https://raw.githubusercontent.com/ravendb/ravendb/v4.1/scripts/certificates/powershell/generate-server-cert.ps1

Create two certificates:

.\generate-server-cert.ps1 -CN *.mooo.com -CertFile server.pfx
.\generate-server-cert.ps1 -CN *.mooo.com -CertFile client.pfx

RavenDb Server Installation

Follow the steps below for each instance of RavenDb e.g. servers raven1, raven2 and raven3 in this example.

Extract the RavenDb zip to a folder of your choice e.g. e.g. C:\RavenDB-4.2.0-windows-x64\

Copy server.pfx to RavenDb Server folder (e.g. C:\RavenDB-4.2.0-windows-x64\Server)

In the RavenDb Server folder rename settings.default.json to settings.json and replace the contents with:

replace raven1.mooo.com with the relevant domain - typically this will be the server name + domain name from the certificate

{
  "DataDir": "RavenData",
  "License.Eula.Accepted": true,
  "Setup.Mode": "Secured",
  "Security.Certificate.Path": "server.pfx",
  "Security.Certificate.Password": "",
  "ServerUrl": "https://0.0.0.0:8080",
  "ServerUrl.Tcp": "tcp://0.0.0.0:38888",
  "PublicServerUrl": "https://raven1.mooo.com:8080",
  "PublicServerUrl.Tcp": "tcp://raven1.mooo.com:38888"
}

Ensure DNS exists for your domains. (e.g. raven1.mooo.com) - Use the Windows hosts file if you want to try it out quickly.

Import certificate into the windows certificate store

Using your admin powershell console navigate to base RavenDb Server folder (C:\RavenDB-4.2.0-windows-x64\Server) and run

certutil -f -importpfx -user .\server.pfx

Start RavenDb and checking the installation

Using your admin powershell console navigate to base RavenDb folder (C:\RavenDB-4.2.0-windows-x64) and run run.ps1 or, if you want to run it as a service setup-as-service.ps1

Navigate using Chrome to

https://raven1.mooo.com:8080

If all goes well you should be prompted to select a certificate for authentication.

Thats it! You have now set up your RavenDb instance securely. Join us in Part 2 which discusses how to get your dotnet webapp or service to talk to RavenDb.

//X509Certificate2 certificate = new X509Certificate2(Path.Combine(@"D:\temp\dotnetcore-webapp-spike\aspnetcoreapp\bin\Debug\netcoreapp2.2", "client.pfx"), "fred");

var store = new X509Store(StoreLocation.LocalMachine); x509.Open(OpenFlags.ReadOnly);

sc.exe create a_ravendemo binPath= "C:\temp\ravendemo\bin\Release\netcoreapp2.2\win10-x64\publish\ravendemo.exe --service"

dotnet new webapp -o ravendemo

dotnet add package RavenDB.Client --version 4.1.5 dotnet add package Microsoft.AspNetCore.Hosting.WindowsServices

dotnet publish -c Release -r win10-x64