Turning on HTTPS
Applies to: Workspace Admins on a server with one organization (otherwise the IT Admin), with help from the IT Admin User · Time: about 10 minutes
Overview
HTTPS encrypts the connection between browsers and your server, so passwords and data can't be read on the network. It is also required for microphones in Huddles, for single sign-on with Microsoft 365 and for connecting Gmail or Outlook mailboxes.
Choose an option
| Option | When to use it | What you need |
|---|---|---|
| Your company's certificate | Recommended | A certificate file (.crt, .cer or .pem) and its private key file (.key or .pem), issued for the server name by your IT team or a certificate provider. Include the intermediate certificates in the certificate file if you have them. |
| This server's own certificate | Nothing to buy | Your IT Admin User installs the server's root certificate on company PCs (for example by Group Policy). Until then, browsers show a warning. |
| Automatic (Let's Encrypt) | Only for a public name | The server name is public on the internet, and ports 80 and 443 reach this server. |
Steps
- Ask the IT Admin User to add a DNS name for the server in the company DNS (for example workspace.company.uz). With this server's own certificate an IP address also works.
- Open Workspace settings → HTTPS.
- Under How to turn on HTTPS, choose the option.
- Enter the Server name.
- For your company's certificate: click Choose file under Certificate file and under Private key file. The private key is stored encrypted on the server.
- Click Save. The server switches over within a few seconds.
- Click Check HTTPS to confirm it works.
- Open the new HTTPS address, sign in again, return to Workspace settings › HTTPS and turn on Send everyone to HTTPS. This switch can be turned on only from a page opened over HTTPS, so nobody gets locked out. With Automatic (Let's Encrypt) there is no switch: people are sent to HTTPS automatically.
- Open Workspace settings › Mail server and check that the Web address starts with https://.
This server's own certificate: the root certificate
With this option, click Download root certificate on the HTTPS tab and give the file to your IT Admin User. They install it on company PCs as a trusted root certificate:
- Windows: Group Policy › Trusted Root Certification Authorities
- Mac: Keychain Access › System › Always Trust
After that, browsers open the server without warnings.
If something goes wrong
The app stays reachable at http://<server IP>:3000, and the IT Admin User can turn HTTPS off on the server with docker compose exec app dw https off (run in /opt/digital-workspace).
Tip
Your company already has its own reverse proxy (nginx, IIS)? Point it at port 3000 and leave HTTPS off in Workspace settings. Then allow port 3000 only from that proxy (see "Security and operations checklist").
Troubleshooting
| Symptom | Resolution |
|---|---|
| "This server doesn't have the built-in web proxy yet." | Install the latest update first (see "Installing updates"). |
| Browsers show a certificate warning | With this server's own certificate, install the root certificate on the PCs. With your company's certificate, check that it was issued for exactly the server name and includes the intermediate certificates. |
| You have a .pfx file | Ask the IT Admin User to convert it: openssl pkcs12 -in cert.pfx -out cert.pem -nodes. |
| Send everyone to HTTPS can't be switched on | Open the page at the HTTPS address shown, then try again. |
These articles are also in the Knowledge Base on your own server, after it is updated.