Configure the TLS/SSL Protocol

The internal and nginx webservers support TLS/SSL Protocol communication via "https" - prefixed URLs when configured correctly.

Note: TLS encryption is enabled for client communication to the VOV port by default starting in 2025.1.0. TLS can be disabled by setting the new comm.tls.enable server configuration parameter to 0. Older version clients that do not use TLS will be allowed to connect without TLS encryption.

The vovserver serves content to a proxy webserver (nginx), which communicates to web browser clients. Under this model, SSL can be enabled, securing all traffic using the HTTP protocol.

When SSL is enabled, nginx will look for an SSL certificate/key pair in the following locations:

Order Type Path Files
1. Site-wide wildcard $VOVDIR/local/ssl wildcard-crt.pem

wildcard-key.pem

2. Host-specific $SWD/config/ssl hostname-crt.pem

hostname-key.pem

3. Host-specific (auto-generated and self-signed) $SWD/config/ssl hostname-self-crt.pem

hostname-self-key.pem

Note:
  • For hostname, use the actual host name that will be used to access the web UI. This will be the value of VOV_HOST_HTTP_NAME that was set in the configuration. If not defined, the value of VOV_HOST_NAME is used instead.

    To use the fully qualified domain name, the value of VOV_HOST_HTTP_NAME must be set.

  • Self-signed certificates will present security warnings in most browsers.

Updating the TLS/SSL cert requires restarting the webserver so that the cert files can be re-read. For the internal webserver, see, "Restarting the Webserver" below.