Using HTTPS

HTTPS is a protocol that encrypts and authenticates communication between a web browser and a web server.

note

A certificate is required to use HTTPS.

Creating SSL Certificates

Create SSL Certificates

warning

Even with a self-signed certificate, most browsers will classify Web Management under HTTPS as "not secure." The connection is still encrypted, but the authenticity of the website cannot be verified by the browser.

Create an OPC Router Container with HTTPS

The following command applies to a Bash shell on Linux or macOS; $PWD refers to the current directory where the certificate and key are located.

docker run -d \
    -e OR_I_ACCEPT_EULA=true \
    -v $PWD/https.pem:/inray/https.pem \
    -v $PWD/https.key:/inray/https.key \
    -e OR_WEB_HTTPS_CERTIFICATE_PEM_FILE=/inray/https.pem \
    -e OR_WEB_HTTPS_CERTIFICATE_KEY_PEM_FILE=/inray/https.key \
    -e OR_WEB_DISABLE_HTTPS=false \
    -p 443:8443 \
    --name opcrouterhttps \
    opcrouter/runtime

In PowerShell on Windows, use the backtick ` for line continuation and ${PWD} for the current directory instead.

note

By executing this command and setting the environment variable OR_I_ACCEPT_EULA to true, you agree to the End User License Agreement.

The added volumes mount the local certificate and local private key on the host and allow the container to access them. Since these are mounts of the local files and not copies, any changes or deletions to the files may affect the container. Alternatively, the certificate and private key can also be transferred to the container using the docker cp command.

note

The container loads the certificate and key at startup. Therefore, after a certificate exchange, restart the container (docker restart opcrouterhttps) so that the new certificate is used.

The environment variables OR_WEB_HTTPS_CERTIFICATE_PEM_FILE and OR_WEB_HTTPS_CERTIFICATE_KEY_PEM_FILE specify the paths to the certificate and the private key. The environment variable OR_WEB_DISABLE_HTTPS is set to false so that HTTPS can be used. The OPC Router’s default HTTPS port (8443) is exposed to the outside as 443. Web Management should now be accessible at [https://localhost](https://localhost).

The HTTP port remains usable: As soon as HTTPS is available, the port specified via OR_WEB_HTTP_PORT points to the HTTPS port. In the command above, the HTTP port is not published, so the web management interface is accessible exclusively via HTTPS. If you also want to publish it, expose it with an additional -p—a request to that address will then be redirected to the HTTPS address. For an overview of the port variables, see Configurable Environment Variables.