Configure the TLS/SSL Protocol
The internal and nginx webservers support TLS/SSL Protocol communication via "https" - prefixed URLs when configured correctly.
comm.tls.enable
server configuration parameter to 0. Older
version clients that do not use TLS will be allowed to connect without TLS
encryption. The vovserver serves content to a proxy webserver (nginx), which communicates to web browser clients. Under this model, SSL can be enabled, securing all traffic using the HTTP protocol.
When SSL is enabled, nginx will look for an SSL certificate/key pair in the following locations:
Order | Type | Path | Files |
---|---|---|---|
1. | Site-wide wildcard | $VOVDIR/local/ssl | wildcard-crt.pem wildcard-key.pem |
2. | Host-specific | $SWD/config/ssl | hostname-crt.pem hostname-key.pem |
3. | Host-specific (auto-generated and self-signed) | $SWD/config/ssl | hostname-self-crt.pem hostname-self-key.pem |
- For hostname, use the actual host name that will be used to access the
web UI. This will be the value of VOV_HOST_HTTP_NAME that was set in the
configuration. If not defined, the value of VOV_HOST_NAME is used
instead.
To use the fully qualified domain name, the value of VOV_HOST_HTTP_NAME must be set.
- Self-signed certificates will present security warnings in most browsers.
Updating the TLS/SSL cert requires restarting the webserver so that the cert files can be re-read. For the internal webserver, see, "Restarting the Webserver" below.