# Testing httpPost and encrypted communication **URL:** \ **Category:** Ignition\ **Tags:** ignition80\ **Created:** [March 9, 2021, 5:44am UTC](https://forum.inductiveautomation.com/t/testing-httppost-and-encrypted-communication/44249 "2021-03-09T05:44:26Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Neo](https://avatars.discourse-cdn.com/v4/letter/n/9fc348/32.png) [@Neo](https://forum.inductiveautomation.com/u/Neo)\ **Post date:** [March 9, 2021, 5:44am UTC](https://forum.inductiveautomation.com/t/testing-httppost-and-encrypted-communication/44249/1 "2021-03-09T05:44:26Z")
We need to send the data to another system via rest API. This data need to be encrypted. I understand we can use `system.net.httpPost` function to send the data in json format. Is this correct? For encryption, installing SLL certificate on Ignition gateway is sufficient or the web server hosting the API should have SSL certificate (https url) for data encryption? Also, is there any way we can test above function for posting json data using any online tool? ---
**Author:** ![peter](https://avatars.discourse-cdn.com/v4/letter/p/278dde/32.png) [@peter](https://forum.inductiveautomation.com/u/peter)\ **Post date:** [March 9, 2021, 12:36pm UTC](https://forum.inductiveautomation.com/t/testing-httppost-and-encrypted-communication/44249/2 "2021-03-09T12:36:24Z")
I don’t know about the requirements for encryption, but the standard way to see the results on the wire would be to use [Wireshark](https://www.wireshark.org). It should be obvious when encryption is enabled as you will no longer be able to see the payload as plain text. ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [March 9, 2021, 5:51pm UTC](https://forum.inductiveautomation.com/t/testing-httppost-and-encrypted-communication/44249/3 "2021-03-09T17:51:30Z")
You're going down a dangerous path, since, frankly, you seem uninformed about a lot of the specifics of the technologies involved here. To answer your specific questions: > [@Neo](#): > > I understand we can use `system.net.httpPost` function to send the data in json format. Is this correct? Yes, but this could be misleading. JSON is just a way to organize a plain-text payload, and doesn't imply anything about encryption. > [@Neo](#): > > For encryption, installing SLL certificate on Ignition gateway is sufficient or the web server hosting the API should have SSL certificate (https url) for data encryption? Installing an **SSL** certificate on the Ignition gateway will do absolutely nothing for any calls to an external REST API. You need to have a certificate for _that_ server (and enable whatever features on the server necessary to 'upgrade' requests to HTTPS) to ensure communication from clients (such as scripting methods in Ignition) must be encrypted. > [@Neo](#): > > Also, is there any way we can test above function for posting json data using any online tool? Local clients that can talk to arbitrary webservers abound. E.G: [https://www.postman.com/](https://www.postman.com/) > **[Hoppscotch • Open source API development ecosystem](https://hoppscotch.io/)** > > Helps you create requests faster, saving precious time on development. > **[Desktop API Design Editor and API Client](https://insomnia.rest/products/insomnia)** > > Build and test APIs quickly with our streamlined Desktop API client and collaborative API design editor. Powershell has a cmdlet for talking to REST APIs: > **[Invoke-RestMethod (Microsoft.PowerShell.Utility) - PowerShell](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-restmethod?view=powershell-7.4&viewFallbackFrom=powershell-7.1)** > > The Invoke-RestMethod cmdlet sends HTTP and HTTPS requests to Representational State Transfer (REST) web services that return richly structured data. PowerShell formats the response based to the data type. For an RSS or ATOM feed, PowerShell returns... Or if you're on a \*nix system, you're basically guaranteed to have `curl` installed. ---
**Author:** ![Neo](https://avatars.discourse-cdn.com/v4/letter/n/9fc348/32.png) [@Neo](https://forum.inductiveautomation.com/u/Neo)\ **Post date:** [March 10, 2021, 8:51am UTC](https://forum.inductiveautomation.com/t/testing-httppost-and-encrypted-communication/44249/4 "2021-03-10T08:51:58Z")
Thanks @paul-griffith for detailed answer. Can you please confirm my understanding below - 1. SSL certificate on Ignition ensures secure communication as long as Ignition is working as server (like communication between clients and Ignition gateway or Ignition as web server). 2. `system.net.httpPost()` with https url endpoint (to be provided by server where data will be sent to) will ensure encryption. (Someone with similar limited knowledge about API calls as me asked if _http_Post function can call _https_ url. Though I thought it can, I did not have definite answer, so just wanted to confirm) I will try one of the above options for testing API call. ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [March 10, 2021, 3:32pm UTC](https://forum.inductiveautomation.com/t/testing-httppost-and-encrypted-communication/44249/5 "2021-03-10T15:32:42Z")
> [@Neo](#): > > SSL certificate on Ignition ensures secure communication as long as Ignition is working as server (like communication between clients and Ignition gateway or Ignition as web server). Yes, that's essentially correct. Note that Ignition has a specific toggle to _require_ HTTPS - if not enabled, then both encrypted and unencrypted sessions are allowed. You can also opt-in to HSTS (Http Strict Transport Security) by setting a [gateway configuration flag](https://docs.inductiveautomation.com/display/DOC81/Gateway+Configuration+File+Reference#GatewayConfigurationFileReference-GatewaySecurityHTTPHeadersandConfiguration); briefly, HSTS lets clients know to 'cache' the HTTPS requirement and never allow HTTP connections for some duration. > [@Neo](#): > > `system.net.httpPost()` with https url endpoint (to be provided by server where data will be sent to) will ensure encryption. (Someone with similar limited knowledge about API calls as me asked if _http_ Post function can call _https_ url. Though I thought it can, I did not have definite answer, so just wanted to confirm) Yes, as long as you're connecting to an HTTPS URL, the _protocol_ will dictate/require encryption to connect. Note that _encryption_ does not mean _security_, intrinsically - you can generate a 'self-signed' certificate, and still send perfectly valid HTTPS traffic over it. Such a self signed certificate can be compromised or duplicated such that a 'bad actor' could still capture your encrypted traffic in-transit over the network and decrypt it. ---
**Author:** ![Neo](https://avatars.discourse-cdn.com/v4/letter/n/9fc348/32.png) [@Neo](https://forum.inductiveautomation.com/u/Neo)\ **Post date:** [March 11, 2021, 6:18am UTC](https://forum.inductiveautomation.com/t/testing-httppost-and-encrypted-communication/44249/6 "2021-03-11T06:18:58Z")
Thank you @paul-griffith for detailed and easy to understand explanation. With IT and OT worlds converging, we need to regularly interact with client’s IT team especially for cyber security. Such conversations in this forum are very helpful to enhance the knowledge.