URL & SSL Certificate

The final step is the configuration of the domain the application will be running on. There are 2 possible setups:

• The application is running behind a reverse-proxy or load-balancer

• The application is exposed to the internet

Configured with direct access from the Internet

This indicates that the machine is not running behind a reverse proxy or load balancer.

Only use this setup if the server is directly exposed to the internet.

Configuration Example:

Field	Value
Hostname	wbe.yourdomain.com
Port	443
Domain	wbe.yourdomain.com (no path)
SSL Certificate	Upload a full-chain certificate

Make sure port 443 is not already in use. Otherwise, the application may fail to start due to a port conflict.

The protocol (e.g. http:// or https://) should be omitted in the domain field.

Configured behind Reverse Proxy/Load Balancer

When the machine where WriteBackExtreme is going to be installed is not directly accessible from outside and has a load balancer or reverse proxy that redirects the incoming traffic from the domain to this machine, then you need to check the Application is running behind a load balancer option. The message on the top indicates how it should be configured at the load balancer/proxy side.

Configuration Example:

Field	Value
Hostname	localhost
Port	8081 (or your internal port)
Domain	wbe.yourdomain.com (no path)
External Port	443
SSL Certificate	Upload a full-chain certificate (.crt/.key or .pfx)

Do not include a path (like /backend or /extension) in the domain field. Only the domain is valid here.

The protocol (e.g. http:// or https://) should be omitted in the domain and hostname field.

Troubeshooting SSL Certifications

Sometimes the application does not like the provided ssl certificates. These error could occur:

Failed to decode PEM block containing private key

1. Open keyfile and check if it starts with -----BEGIN PRIVATE KEY-----

If there is something above this line, delete it. (Same applies to certificates!)

1. Open your keyfile and check if it is encrypted. (Encrypted private keys start with -----BEGIN ENCRYPTED PRIVATE KEY-----) When it is encrypted, you need to decrypt it. You can do that via openssl (if installed on your machine) in your terminal using the following command:

openssl rsa -in <encrypted_private.key> -out <decrypted_private.key>

Could not unpackage pfx/p12 file - pkcs12: expected exactly two safe bags in the PFX

The PFX file does not have the correct format. The best way is to convert pfx into a .crt and .key file. You can do this via openssl when this is installed on your system:

## extract the key from the pfx file
openssl pkcs12 -in [yourfile.pfx] -nocerts -out certificate.key

## extract the certificate from the pfx file
openssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out certificate.crt

## Decrypt the keyfile
openssl rsa -in certificate.key -out certificate-decrypted.key

# Upload the certificate-decrypted.key and certificate.crt to writeback. 

Certificate does not match domain/IP

If you are using an IP address instead of a domain name, make sure the certificate includes the IP in the Subject Alternative Name (SAN) field.

• Example for OpenSSL:

  -addext "subjectAltName=IP:12.0.19.89"

  (Use IP: instead of DNS: when adding an IP address).

• Example for OpenSSL:

  -addext "subjectAltName=DSN:yourhostname"

  (Use DNS: when adding a Domain).

Important:

• If you change the certificate creation string, you must also regenerate both the .crt and the .key files and update them in the Management Console. Using a mismatched .crt and .key will cause errors.

Server startup problems

Could not startup server, Contact Apps For Tableau support when the problem persists

The app server is unable to start. This can have multiple causes like:

• Application is configured as administrator but is currently not running with administrator previleges.

• Check if there is no other WriteBackExtreme proces running in the background. Open Task manager and select the Details tab. You should have only one process called WriteBackExtreme.

• Check if there is no other process running on the port that is configured in WriteBackExtreme. You can do that with this command in cmd:

netstat -aon

• Check is the application log. This log file is located at <path>/.wbe-runtime/storage/logs/wbe-application.log

• Open powershell and navigate to the directory where WriteBackExtreme.exe is located. run this command to manually trigger the application server:

./WriteBackExtreme.exe serve

This command might give more details about what went wrong.

listen tcp :443: bind: Only one usage of each socket address (protocol/network address/port) is hormally permitted

When this error appears in your wbe-application.log it is not able to spin the server because the port you have configured is already in use by another program.