# NEW Web Server Config Page and SSL / TLS Setup Wizard **URL:** \ **Category:** Ignition Early Access\ **Created:** [June 11, 2019, 5:05pm UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732 "2019-06-11T17:05:40Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [June 11, 2019, 5:05pm UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/1 "2019-06-11T17:05:40Z")
The last 8.0.3 early access build includes a new config page titled “Web Server” under the “Networking” section along with significant changes to how SSL / TLS is managed. Following are the details: **Gateway Properties** The following properties may now be configured from the Gateway config web interface: - HTTP Port - HTTPS Port - Force Secure Redirect - Included Cipher Suites - Excluded Cipher Suites Changes to these properties take effect to the running Gateway immediately (no restart required). This is important to be aware of since this will affect any existing connections to the Gateway. HTTP and HTTPS ports continue to be persisted in gateway.xml with properties `gateway.port` and `gateway.sslport` respectively. The force secure redirect flag is persisted in gateway.xml with property `gateway.forceSecureRedirect` and defaults to `false`. When set to true, the Gateway will redirect all HTTP traffic to HTTPS _if HTTPS is set up_ (more on this below). This option deprecates the “Use SSL” option which used to exist in the “Gateway Settings” page but is now removed. User included and excluded cipher suites are now persisted as a JSON-encoded array of Strings in gateway.xml with properties `gateway.includedCipherSuites` and `gateway.excludedCipherSuites` respectively. When the gateway starts up, if these properties are not set in gateway.xml, it will pull any values from system properties `ciphers` and `excludedCiphers` (where they used to be set) and set them accordingly in gateway.xml. Note: changing these properties directly in the gateway.xml file on the filesystem will not affect the running Gateway until it is restarted. Only changes through the Gateway web interface take immediate effect without a restart. **SSL / TLS Setup** Prior to 8.0.3, setting up a genuine SSL certificate was a major pain point. We aim to improve that experience by introducing an SSL / TLS setup wizard in the new Web Server config page. The wizard will guide you through the process of generating a CSR and uploading the necessary server and CA certificates in the right order. On upgrade, if SSL was already set up, it will continue to work. However, on fresh installs, SSL / TLS will not be setup by default. You must go through the SSL / TLS setup wizard to install an SSL certificate in order to enable HTTPS. Note that it is also possible to delete the SSL certificate installed on the Gateway, which will disable SSL / TLS. The Gateway’s SSL key store is now persisted in `$IGNITION/webserver/ssl.pfx` formatted as a PKCS12 key store, an open standard supported by tools such as `openssl`. The alias of the certificate chain and private key can be set using system property `ignition.ssl.keystore.alias` (defaults to `ignition`) and the password can be set using system property `ignition.ssl.keystore.password` (also defaults to `ignition`). Note: changing the key store file directly on the filesystem will not affect a running Gateway until it is restarted. Only changes though the Gateway web interface will take immediate effect without requiring a restart. **Stronger Default Cipher Suites** The following cipher suites have been excluded by default in order to increase the strength of the default SSL / TLS profile of the Gateway: ```auto TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 ``` If you experience any issues connecting to the SSL port of the Gateway using the launchers, download the latest launchers from the Gateway, as we added support for stronger ciphers. As an alternative workaround, you could weaken your cipher suites by including one of the above, but that is not recommend. Hope you all enjoy these new features! ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [June 11, 2019, 5:10pm UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/2 "2019-06-11T17:10:38Z")
---
**Author:** ![silverbacknet](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/silverbacknet/32/7385_2.png) [@silverbacknet](https://forum.inductiveautomation.com/u/silverbacknet)\ **Post date:** [July 10, 2019, 12:45am UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/3 "2019-07-10T00:45:23Z")
I haven’t yet upgraded to 8.0.3, but does it allow you to import an existing .pfx or a set of PEM files/paste? Or should I count on just replacing ssl.pfx? Most importantly, since pfx is password-encrypted, how does that work? Just blank password? My current plan is to use Let’s Encrypt via Certify, and use a post-renewal action to build and copy the pfx cert and restart the gateway, but I’d like to be able to manually import to get it working and verify initially. ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [July 10, 2019, 12:54am UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/4 "2019-07-10T00:54:15Z")
Hi @silverbacknet - You could create the PKCS12 key store and copy into `$IGNITION/webserver/ssl.pfx`. You will need to restart the gateway to apply the change. You could also take the .pem certs from Let’s Encrypt and drag / drop into the new web config interface or paste the PEM’s text into the web config interface. The interface is a wizard which guides you through setting up the private key, server certificate, any intermediary CA certificates, and the root CA certificate. We are also getting real close to enabling hot-reload of the key store but it has not yet been merged in. This would allow better support for Let’s Encrypt. We will provide more detail when this feature is available. For the key store password: the Gateway uses whatever password is in system prop `ignition.ssl.keystore.password` (default is `ignition`). ---
**Author:** ![Herbie](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/herbie/32/65288_2.png) [@Herbie](https://forum.inductiveautomation.com/u/Herbie)\ **Post date:** [July 10, 2019, 1:12am UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/5 "2019-07-10T01:12:29Z")
This will be awesome! We had semi-automated this through some scripting (it is a very tedious process), but this will make things work so much easier! Look forward to migrating to 8. ---
**Author:** ![silverbacknet](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/silverbacknet/32/7385_2.png) [@silverbacknet](https://forum.inductiveautomation.com/u/silverbacknet)\ **Post date:** [July 10, 2019, 1:24am UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/6 "2019-07-10T01:24:36Z")
Thanks! This will make life so much simpler once I upgrade! ❤ ---
**Author:** ![silverbacknet](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/silverbacknet/32/7385_2.png) [@silverbacknet](https://forum.inductiveautomation.com/u/silverbacknet)\ **Post date:** [July 10, 2019, 1:32am UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/7 "2019-07-10T01:32:35Z")
> [@jspecht](#): > > We are also getting real close to enabling hot-reload of the key store but it has not yet been merged in. I'm pushing my client toward upgrading to a fully released version (they're on an early nightly of 8.0.2 right now), so if that gets in, it'll be a total killer feature. No downtime at all! It's every administrator's dream and every engineer's headache. ---
**Author:** ![DavidWisely](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/davidwisely/32/10482_2.png) [@DavidWisely](https://forum.inductiveautomation.com/u/DavidWisely)\ **Post date:** [July 12, 2019, 7:32am UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/8 "2019-07-12T07:32:23Z")
Hi @jspecht I just tried this and failed. I put the ssl.pfx file (PKCS12 key store) in the webserver folder and restarted. The logs displayed the error below. Does this mean Ignition found the file, but the format was different to what it expected? Any ideas what I need to do to fix this? Thanks ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/3/3c30f4da167725fb9079475b3649c7660c2dd141.png) ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [July 12, 2019, 3:11pm UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/9 "2019-07-12T15:11:51Z")
Hi @DavidWisely - Ignition looks for the entry in the key store with whatever alias is specified in system prop `ignition.ssl.keystore.alias`. If you have no value specified in the system prop, the default alias is `ignition`. Looks like it could not find an entry with the target alias. To get it working, either change the entry’s alias to `ignition` in the key store or set the system prop to the alias set in the key store. ---
**Author:** ![Kyle\_Chase](https://avatars.discourse-cdn.com/v4/letter/k/9de0a6/32.png) [@Kyle\_Chase](https://forum.inductiveautomation.com/u/Kyle_Chase)\ **Post date:** [July 12, 2019, 3:21pm UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/10 "2019-07-12T15:21:42Z")
This is great, LE support will be awesome. Currently, we run a reverse proxy in front of Ignition servers just for the ability to use LE certificates without needing downtime to swap them every few months. ---
**Author:** ![DavidWisely](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/davidwisely/32/10482_2.png) [@DavidWisely](https://forum.inductiveautomation.com/u/DavidWisely)\ **Post date:** [July 16, 2019, 6:56am UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/11 "2019-07-16T06:56:27Z")
> [@jspecht](#): > > system prop Thanks @jspecht, How do I check and update the system property? When I run system.util.getProperty('ignition.ssl.keystore.password') on the gateway I get null. How do I set it? ---
**Author:** ![jcoffman](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jcoffman/32/6429_2.png) [@jcoffman](https://forum.inductiveautomation.com/u/jcoffman)\ **Post date:** [July 16, 2019, 3:13pm UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/12 "2019-07-16T15:13:40Z")
The proper place would be in ignition.conf under a `wrapper.java.additional` parameter ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [July 18, 2019, 8:26pm UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/13 "2019-07-18T20:26:10Z")
The latest nightly build includes better support for Let’s Encrypt and will also be in 8.0.3. In order to better support Let’s Encrypt, the Gateway now checks to see if `$IGNITION/webserver/ssl.pfx` has changed every 15 minutes by default (configurable with system prop `ignition.ssl.refresh` - set to 0 to disable automatic refresh). If the key store on disk differs from the current SSL key store in memory, the in memory key store is replaced with the one on disk. The SSL connector is hot-reloaded with the new key store. Also added a GCU command to hot-reload the SSL key store with the current one on disk on-demand: `-g, --reloadks : Reloads the gateway's SSL key store from disk. The gateway's SSL / TLS connector will not be interrupted. Existing connections will use the previous certificate while new connections will be served the new certificate.` Those who wish to use Let’s Encrypt certs with the Gateway may now automatically rotate certs by leveraging a script which builds the PKCS12 key store and writes it to `$IGNITION/webserver/ssl.pfx`. You can then wait for the automatic refresh to pick up the change or manually invoke the change by calling the above GCU command as a part of a script. ---
**Author:** ![jpark](https://avatars.discourse-cdn.com/v4/letter/j/a88e57/32.png) [@jpark](https://forum.inductiveautomation.com/u/jpark)\ **Post date:** [July 18, 2019, 11:27pm UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/14 "2019-07-18T23:27:06Z")
So with the latest 8.0.4 I get the following in the logs every 15 minutes. I do not have ssl enabled. java.lang.Exception: PKIX certificate path validation failed at com.inductiveautomation.ignition.gateway.ssl.CertificateValidationUtil.verifyTrustChain(CertificateValidationUtil.java:288) at com.inductiveautomation.ignition.gateway.ssl.CertificateValidationUtil.verifyTrustChain(CertificateValidationUtil.java:105) at com.inductiveautomation.ignition.gateway.ssl.SslManager.validateKeyStore(SslManager.java:259) at com.inductiveautomation.ignition.gateway.ssl.SslManager$AbstractStateReader.readState(SslManager.java:296) at com.inductiveautomation.ignition.gateway.ssl.SslManager.refreshInternal(SslManager.java:435) at com.inductiveautomation.ignition.gateway.ssl.SslManager.refresh(SslManager.java:398) at com.inductiveautomation.ignition.gateway.ssl.SslManager.lambda$scheduleNextRefresh$1(SslManager.java:385) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) at java.base/java.util.concurrent.FutureTask.run(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.base/java.lang.Thread.run(Unknown Source) Caused by: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty at java.base/java.security.cert.PKIXParameters.setTrustAnchors(Unknown Source) at java.base/java.security.cert.PKIXParameters.(Unknown Source) at java.base/java.security.cert.PKIXBuilderParameters.(Unknown Source) at com.inductiveautomation.ignition.gateway.ssl.CertificateValidationUtil.verifyTrustChain(CertificateValidationUtil.java:226) … 11 common frames omitted ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [July 18, 2019, 11:38pm UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/15 "2019-07-18T23:38:18Z")
Hi @jpark - Looks like you are upgrading from an older version which uses a java key store at `$IGNITION/webserver/ssl.key`. Do you have a root CA cert in the SSL key store’s cert chain? ---
**Author:** ![kumar.chellappan](https://avatars.discourse-cdn.com/v4/letter/k/2acd7d/32.png) [@kumar.chellappan](https://forum.inductiveautomation.com/u/kumar.chellappan)\ **Post date:** [August 13, 2020, 9:59pm UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/16 "2020-08-13T21:59:00Z")
Hi, I have SSL installed and have the ports open for firewall. it doesn’t work with my URL masking. [https://ip](https://ip):port works but loads up as not secure connection. What might be the reason for this? Thank you. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [August 14, 2020, 12:11pm UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/17 "2020-08-14T12:11:29Z")
SSL checks the DNS server names used to make the connection against the name or names in the certificate. You will have to fix your URL “masking”. ---
**Author:** ![Herbie](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/herbie/32/65288_2.png) [@Herbie](https://forum.inductiveautomation.com/u/Herbie)\ **Post date:** [September 1, 2020, 8:34pm UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/18 "2020-09-01T20:34:03Z")
As pturmel suggested, modern browsers have started changing how they validate the site you are communicating with. When we initially create the certificate, you are asked about the name of the computer, which is captured as part of the CN properties of the Subject field (if you look at the certificate details). However, Chrome, along with many other browsers, are now using the Subject Alternative Name field instead, which can contain several items, including DNS Name, IP Address, and some others. If you have having a problem getting the web page to come up without the security warning, you will need to include all DNS names and IP addresses you would typically use to access it (i.e. 127.0.0.1, localhost, etc…). I’m guessing if you added your URL mask as one of the DNS names, it would work. Once alternative you can use now is a wildcard certificate that would have DNS Name=\*.domain.com and would work on several servers. ---
**Author:** ![kumar.chellappan](https://avatars.discourse-cdn.com/v4/letter/k/2acd7d/32.png) [@kumar.chellappan](https://forum.inductiveautomation.com/u/kumar.chellappan)\ **Post date:** [September 10, 2020, 9:56pm UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/19 "2020-09-10T21:56:01Z")
Thank you very much for the replies. I figured it was not an ignition issue rather than moving our domain from one provider to another. ---
**Author:** ![Hitesh\_Rathod1](https://avatars.discourse-cdn.com/v4/letter/h/ea666f/32.png) [@Hitesh\_Rathod1](https://forum.inductiveautomation.com/u/Hitesh_Rathod1)\ **Post date:** [July 1, 2024, 12:48pm UTC](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732/20 "2024-07-01T12:48:42Z")
I am having issue when I move ssl.pfx (PKCS12 key store) file from keyfactor to Ignition webserver directory. The SSL is not activated and giving me below error. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/c/2c28835258cacd8d2292bacb3478c8118c4f0763.png) [Next page](https://forum.inductiveautomation.com/t/new-web-server-config-page-and-ssl-tls-setup-wizard/25732.md?page=2)