# Configure how Liberator handles HTTPS connections Here’s how to configure Liberator’s HTTPS connections. HTTPS is the secure version of HTTP that uses the Secure Sockets Layer of TCP/IP (SSL) and offers a much greater level of protection than standard HTTP transmission. Liberator can run as an HTTPS web server like most common web servers. Web pages and other standard HTTP traffic can be sent over HTTPS, and if HTTPS is enabled all [RTTP](liberator-rttp.md) data is sent over an HTTPS connection too. Liberator supports standard SSL server-side certificates to authenticate the server to the client. They must be generated and signed by a certificate authority. **❗ IMPORTANT**\ In production environments, always use HTTPS connections to Liberator, to ensure high security. Don’t use HTTP in production environments. **💡 TIP**\ Some of the instructions on this page require you to use the `dfw` command of the Deployment Framework. Before entering any `dfw` command as `./dfw `, make sure your current (working) directory is set to the Deployment Framework’s topmost directory. For a list of `dfw` commands, [click here](../deployment-framework/cdf-the-deployment-framework-command-utility-dfw.md). ## Enabling HTTPS Liberator’s supplied with a built-in HTTPS [Config blade](../deployment-framework/cdf-blade-types.md) (see [Built-in blades](../deployment-framework/cdf-built-in-blades.md)), so to enable HTTPS you just activate the blade. To ensure maximum security, you should also _disable_ HTTP connections by deactivating the built-in HTTP blade: ``` ./dfw deactivate HTTP ./dfw activate HTTPS ``` Enabling the HTTPS blade makes the [Deployment Framework](../deployment-framework/index.md) use the blade configuration file _<Framework-root>/kits/HTTPS/Liberator/etc/rttpd.conf_. This file contains configuration items that * enable HTTPS ([https-enable](liberator-https-configuration.md#https-enable)), * define the default interface and port to listen on for clients connecting via HTTPS ([https-interface](liberator-https-configuration.md#https-interface), [https-port](liberator-https-configuration.md#https-port)), * define the default names and directory paths of the files containing the server-side certificate, private key and certificate passphrase ([https-certificate](liberator-https-configuration.md#https-certificate), [https-privatekey](liberator-https-configuration.md#https-privatekey), [https-passwordfile](liberator-https-configuration.md#https-passwordfile)). You can change the default settings of these configuration items as required - see the following sections. If you’re enabling HTTPS for a production environment, you should disable Liberator’s built-in web pages too, by deactivating and activating the following built-in blades: ``` ./dfw deactivate LiberatorWebsite ./dfw activate MinimalLiberatorWebsite ``` ## Configuring Liberator’s HTTPS port and interface When you activate Liberator’s HTTPS Config blade, Liberator by default listens for HTTPS connections on all available interfaces, on port 18081. If you want to change the Liberator’s HTTP connection interface and/or HTTP port, set the following configuration items. To change the Liberator’s HTTP port, add the macro definition `LIBERATOR${THIS_LEG}_HTTPSPORT` to the Deployment Framework file _<Framework-root>/global_config/environment.conf_ Insert the definition at the end of the section headed "Add updated configuration after this point" For example: ``` # # Add updated configuration after this point # ... # # Set Liberator's HTTPS port to the conventional default # define LIBERATOR${THIS_LEG}_HTTPSPORT 443 ``` **📌 NOTE**\ Don’t change value of the configuration item [https-port](liberator-https-configuration.md#https-port) directly. Always define the HTTP port using the macro `LIBERATOR${THIS_LEG}_HTTPSPORT` If you want to restrict Liberator to listening for HTTPS connection requests on specific network interfaces, add the macro definition `LIBERATOR${THIS_LEG}_HTTPINTERFACE` to the Deployment Framework file _<Framework-root>/global_config/environment.conf_ (This macro is used to define both the HTTP and HTTPS network interfaces – it’s assumed that HTTP and HTTPS will always use the same interface. So there’s no macro called `LIBERATOR${THIS_LEG}_HTTPSINTERFACE`) Insert the definition at the end of the section headed "Add updated configuration after this point" For example: ``` # # Add updated configuration after this point # ... # # Restrict Liberator's HTTPS interface to specific network interfaces # define LIBERATOR${THIS_LEG}_HTTPINTERFACE aaa.aaa.aaa.aaa bbb.bbb.bbb.bbb ``` **📌 NOTE**\ Don’t change value of the configuration item [https-interface](liberator-https-configuration.md#https-interface) directly. Always define the HTTP interface using the macro `LIBERATOR${THIS_LEG}_HTTPINTERFACE` ## Applying the security policy The Liberator install kit comes with a set of SSL files containing a certificate, private key and certificate passphrase that are suitable for development and testing purposes. The files were created using the OpenSSL toolkit and consist of: * An SSL certificate file in PEM format: _rttpd_https.pem_ * An SSL private key file in PEM format _rttpd_https.key_ * A file containing the SSL certificate passphrase: _rttpd_https.pwd_ When you deploy Liberator, these files are copied to the [Deployment Framework](../deployment-framework/index.md) directory _<Framework-root>/global_config/ssl/_, provided that there are no files already in this directory. (You may have _production_ versions of the SSL files in the directory - see [Setting certificates for production use](#setting-certificates-for-production-use), in which case, when you deploy a new version of Liberator, the production files aren’t replaced by the development versions.) When you enable Liberator’s built-in **HTTPS** [Config blade](../deployment-framework/cdf-blade-types.md), it uses the SSL files that it finds in _<Framework-root>/global_config/ssl/_ If you’re using the sample SSL files, you’ll need to tell your browser to accept the certificate even though it doesn’t recognise the authority and the certificate isn’t strictly for your installation of the Liberator server. The certificate and certificate authority use the passphrase: `rttpdcert` **💡 TIP**\ For more about the OpenSSL toolkit, see [www.openssl.org](https://www.openssl.org) ## Setting strong encryption (encryption key length) To ensure adequate security In a production deployment, the encryption keys you use (as defined in the certificates -see [Setting certificates for production use](#setting-certificates-for-production-use) below ) must be at least 128 bits long. Additionally, make sure that the list of SSL ciphers (cryptographic algorithms) available to Liberator includes ciphers that support keys of 128 bits or more. The ciphers are selected from the set available in the version of [OpenSSL](https://www.openssl.org/) built into Liberator, and the list is specified by the Liberator configuration item [https-cipher-list](liberator-https-configuration.md#https-cipher-list), which we recommend you define as follows: ``` https-cipher-list HIGH+TLSv1 ``` This configuration setting ensures that HTTPS clients of _Windows-based_ Liberators can use encryption keys of least 128 bits. Linux-based Liberators can use just the value `HIGH`, but `HIGH+TLSV1` amounts to the same thing on LInux, so you can use the above configuration in both Windows and Linux environments. **⚠️ WARNING**\ In Liberators running under Windows, the configuration setting `https-cipher-list HIGH` _won’t_ provide 128 bit encryption capability. For more information about the OpenSSL 1.0.2 cipher list, see the `OpenSSL ciphers(1)` manual page, which includes a list of the available cipher suite names. ## Setting certificates for production use You must obtain your own certificate, private key and passphrase for production use. When you’ve done this: * Put the production files in _<Framework-root>/global_config/ssl/_ * Configure the HTTPS blade to point at the new files. To do this, add the following entries to _<Framework-root>/global_config/overrides/servers/Liberator/etc/rttpd.conf_ ``` xref:liberator-https-configuration.md#https-certificate[https-certificate] ${SSLCERT_PATH}/.pem xref:liberator-https-configuration.md#https-privatekey[https-privatekey] ${SSLCERT_PATH}/.key xref:liberator-https-configuration.md#https-passwordfile[https-passwordfile] ${SSLCERT_PATH}/.pwd ``` Where, of course, `` and so on, are really the actual names of the files. You can see from this example that in the Deployment Framework, a configuration macro `SSLCERT_PATH` is used to specify the directory path to the relevant files. See the Framework [Configuration macros and items page](../deployment-framework/cdf-configuration-macros-and-items.md). **💡 TIP**\ When you set up HTTPS connections to Liberator, you’ll probably want to set up secure direct connections at the same time (see How can I... [Configure how Liberator handles direct client connections](liberator-configure-how-liberator-handles-direct-client-connections.md)). In development and test environments, it’s convenient to share the same certificate, private key file and certificate pass phrase file between these two types of connection. But for added security in production environments, you can configure a different set of these files for each connection type. ## Seeding the OpenSSL random number generator See How can I... [Seed the OpenSSL random number generator](../datasource/datasource-seed-the-openssl-random-number-generator.md). ## Configuring OpenSSL Liberator uses the [OpenSSL](https://www.openssl.org) software to implement the security policies for secure (HTTPS) connections with clients. You can configure OpenSSL using the following DataSource configuration items, which are defined on the page [DataSource Secure Sockets Layer (SSL) configuration](../datasource/datasource-datasource-secure-sockets-layer-ssl-configuration.md): * [`ssl-config-name`](../datasource/datasource-datasource-secure-sockets-layer-ssl-configuration.md#ssl-config-name) * [`ssl-debug`](../datasource/datasource-datasource-secure-sockets-layer-ssl-configuration.md#ssl-debug) * [`ssl-engine-flags`](../datasource/datasource-datasource-secure-sockets-layer-ssl-configuration.md#ssl-engine-flags) * [`ssl-engine-id`](../datasource/datasource-datasource-secure-sockets-layer-ssl-configuration.md#ssl-engine-id) **📌 NOTE**\ When you change the configuration of OpenSSL, the new settings apply to all of Liberator’s secure (SSL) connections: HTTPS connections, [Direct secure connections](liberator-configure-how-liberator-handles-direct-client-connections.md) to clients, and [secure connections between Liberator and other DataSource applications](../datasource/datasource-set-up-secure-connections-between-datasource-applications.md). --- **See also:** * How can I... [Configure how Liberator handles HTTP connections](liberator-configure-how-liberator-handles-http-connections.md) * How can I... [Configure how Liberator handles direct client connections](liberator-configure-how-liberator-handles-direct-client-connections.md) * How can I... [Set up secure connections between DataSource applications](../datasource/datasource-set-up-secure-connections-between-datasource-applications.md) * Reference: [HTTPS configuration](liberator-https-configuration.md) * Reference: [HTTP configuration](liberator-http-configuration-part-1.md)