> For the complete documentation index, see [llms.txt](https://docs.oceanenterprise.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.oceanenterprise.io/infrastructure/user-management-package/deployment-steps/pre-installation-steps.md). # Pre-installation steps Before deploying the User Management Package, a number of foundational preparations must be completed to ensure a secure and reliable installation. These pre‑installation steps —configuring the Fully Qualified Domain Name (FQDN), setting up the required digital certificates, and generating the necessary private keys—form the technical baseline for the deployment. They must be performed **in both deployment modes**, for dataspace operators as well as dataspace participants, to guarantee that each environment is correctly prepared for the subsequent installation and configuration stages. ## Enabling TCP Ports Ensure that all required deployment ports, including both the implicit ports defined in the [TCP Ports Configuration](/infrastructure/user-management-package.md#tcp-ports-configuration) section and any custom-configured ports, are available on the host and do not conflict with ports used by other processes. ## Setting up FQDN Before starting the services, this stack requires at minimum a Fully Qualified Domain Name (FQDN) to be configured for the following: * `wallet-ui` * `wallet-api` * The VM used to run the entire stack Add DNS records for the services listed above in your DNS server or DNS management platform. Examples of widely used DNS management platforms are [Cloudflare](https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/), [Amazon Route 53](https://aws.amazon.com/route53/), [Google Cloud DNS](https://cloud.google.com/dns?hl=en), [Azure DNS](https://azure.microsoft.com/en-us/products/dns), etc. ## **SSL Certificates Generation & Configuration** Use this guide to generate digital certificates for: the server that will run the User Management Package, Traefik service, Signer Server service, and OpenBao vault. For production: * use valid CA-issued certificates; * include all required hostnames in SANs; * use separate private keys where policy requires separation of duties; * do not keep certificate private keys in Git; * mount certificates from a protected deployment secret mechanism where possible; * renew certificates before expiry and safely restart/reload affected services. Traefik dynamic TLS configuration currently loads: ```yaml tls: certificates:   - certFile: /certs/fullchain.pem     keyFile: /certs/privkey.pem options:   default:     minVersion: VersionTLS12 ``` {% hint style="info" %} Ensure Traefik certificate files are present within `certs/` directory from `traefik/` and file names are `fullchain.pem` and `privkey.pem` . {% endhint %} A common setup is installing a free SSL/TLS certificate from [Let's Encrypt](https://letsencrypt.org/) using [Certbot](https://certbot.eff.org/). For using this mix, a good starting point is . **Note**: This solution is using Traefik, so for specific instructions, the user must select "`My HTTP website is running`` `**`Other`**` ``on "` **Note**: For OpenBao, the certificate files must be added to `/docker-compose/openbao/certs`. {% hint style="info" %} For secure communication using the HTTPS protocol, OpenBAO can import SSL certificates. A simpler setup is to generate self-signed certificates with the `opensssl` tool within `/docker-compose/openbao/certs`. Command for generating self-signed certificates: {% code overflow="wrap" lineNumbers="true" %} ```console openssl req -x509 -newkey rsa:4096 -keyout ./openbao/certs/tls.key -out ./openbao/certs/tls.crt -days 365 -nodes \ -subj "/CN=openbao" \ -addext "subjectAltName=DNS:openbao,DNS:localhost,IP:127.0.0.1" ``` {% endcode %} {% endhint %} ## Private Key Generation for OpenBao Vault For web3 account generation and Vault management, please consult dedicated sections: * [Generate Private Keys](/infrastructure/signer-server-installation-and-configuration/key-generation-and-management-in-openbao-secrets-vault/generate-private-keys.md) * [Key Storage & Management in OpenBao](/infrastructure/signer-server-installation-and-configuration/key-generation-and-management-in-openbao-secrets-vault/key-storage-and-management-in-openbao.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.oceanenterprise.io/infrastructure/user-management-package/deployment-steps/pre-installation-steps.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.