Skip to content

HTTPS Configuration

Enabling HTTPS in Router

The application uses Nginx as a router for handling HTTPS requests. HTTPS is required for secure communication. To enable HTTPS, you need to configure the Nginx settings with SSL certificates.

Prerequisites

  • DNS A Records: Properly configured DNS A records pointing to your server's IP address (if using a domain name).
  • SSL Certificates: SSL certificates are automatically configured during the set_hostname script execution. The certificates are stored in the router directory and can be either:
  • Your own valid SSL certificate (.crt file) and key (.key file).
  • A self-signed certificate automatically generated by the set_hostname script.

Nginx Configuration Directory

The Nginx configuration files are located in the router directory under the application's installation path. This directory is mounted into the Nginx container using the Docker Compose configuration.

Example Nginx Configuration for HTTPS

Below is an example of the relevant part of the Nginx configuration file. The set_hostname script automatically configures these settings, but you can verify or manually adjust them if needed:

Nginx Configuration File
### UNCOMMENT THE LINES BELOW TO CONVERT APPLICATION TO HTTPS

server {
    listen 80;
    return 301 https://$server_name$request_uri;
}

server {
   listen 443 ssl default_server;

   ssl_certificate /etc/nginx/conf.d/selfsigned.crt;
   ssl_certificate_key /etc/nginx/conf.d/selfsigned.key;
}

Steps to Enable HTTPS

1. Run the set_hostname Script

The set_hostname script automatically configures HTTPS for your application. During execution, you will be prompted to either provide your own SSL certificate or generate a self-signed certificate. The certificates will be automatically placed in the router directory.

Refer to the Hostname Configuration section for detailed instructions on running the script.

2. Copy Certificate to Backend Container

For the backend service to recognize the SSL certificate, you need to copy the .crt file to the backend container's /app/certs directory.

Bash
docker cp router/selfsigned.crt dataprivacy-backend:/app/certs/

Note: If you used your own certificate with a different name, replace selfsigned.crt with your certificate file name.

3. Verify SSL Certificate Paths

Update the ssl_certificate and ssl_certificate_key paths in the default.conf file to match the names and locations of the certificate files you placed in the router directory. For example:

Text Only
ssl_certificate /etc/nginx/conf.d/example.crt;
ssl_certificate_key /etc/nginx/conf.d/example.key;

4. Restart the Router

After making these changes, restart the router service using the following command:

Bash
docker compose restart router

5. Restart Backend Service

Restart the backend service to ensure it recognizes the SSL certificate:

Bash
docker compose restart dataprivacy-backend

6. Update Hostname Configuration

After switching to HTTPS, some applications may require reconfiguration. Set the hostname according to your DNS address. Refer to the Hostname Configuration section for details.

7. Update Keycloak Configuration

Update the datafocusId client in Keycloak. Follow the instructions in the Keycloak Configurations section to complete the update.

Verification

Once these configurations are complete, you can access Data Privacy over HTTPS at:

Text Only
https://<hostname>

Success: Your application is now running securely over HTTPS. All HTTP traffic will be automatically redirected to HTTPS.

Warning: If you used a self-signed certificate, browsers will display a security warning. This is normal for self-signed certificates. For production environments, consider using a certificate from a trusted Certificate Authority.

Troubleshooting

If you encounter issues after enabling HTTPS: 1. Check Certificate Paths: Verify that the certificate paths in router/default.conf are correct.

  1. Verify Certificate Files: Ensure the .crt and .key files exist in the router directory.

  2. Check Backend Certificate: Confirm the certificate was copied to /app/certs/ in the backend container.

  3. Review Logs: Check the router and backend container logs for any errors:

    Bash
    docker logs router
docker logs dataprivacy-backend

  4. Restart Services: Try restarting all services:

    Bash
    docker compose restart