Enable HTTPS¶

Why HTTPS matters

Web browsers such as Chrome require Drovio Server to be accessed over HTTPS for a user to share their microphone and / or webcam from the web client.

Steps¶

Get a certificate, an intermediary certificate and a private key (.crt / .key or .pem) from your CA. They are named drovioserver.crt, ca.crt and drovioserver.key in the following commands.

On the machine where Drovio Server is deployed, run the following commands. Replace eUv4ffT4 with a password of your own and your_hostname with the hostname the certificate was issued for. The first command deletes the existing keystore so the import starts from a clean file; back it up first if you have one you care about. This is not the SAML keystore, which is a separate file pointed to by users.auth.saml.keystore.

LinuxWindows

rm /etc/drovio-server/keystore.jks

openssl pkcs12 -export -in drovioserver.crt -inkey drovioserver.key \
  -certfile ca.crt -out pkcs2.p12 -name your_hostname -password pass:eUv4ffT4

keytool -importkeystore -deststorepass eUv4ffT4 -destkeypass eUv4ffT4 \
  -destkeystore /etc/drovio-server/keystore.jks \
  -srckeystore pkcs2.p12 -srcstoretype PKCS12 -srcstorepass eUv4ffT4 \
  -alias your_hostname

Remove C:\ProgramData\Drovio\Drovio Server\keystore.jks, then:

openssl pkcs12 -export -in drovioserver.crt -inkey drovioserver.key ^
  -certfile ca.crt -out pkcs2.p12 -name your_hostname -password pass:eUv4ffT4

keytool -importkeystore -deststorepass eUv4ffT4 -destkeypass eUv4ffT4 ^
  -destkeystore "C:\ProgramData\Drovio\Drovio Server\keystore.jks" ^
  -srckeystore pkcs2.p12 -srcstoretype PKCS12 -srcstorepass eUv4ffT4 ^
  -alias your_hostname

Windows tooling

Download OpenSSL binaries, e.g. from https://indy.fulgan.com/SSL/.
The keytool command is located in the Java JRE bin folder, already installed under C:\Program Files\Java\ along with Drovio Server.

Change the following fields in the configuration file (or directly from the administration panel), in the http section:
```
"tls": true,
"keystore": "/etc/drovio-server/keystore.jks",
"keystore_password": "eUv4ffT4",
"https_port": 443
```
Setting https_port matters: enabling TLS alone leaves the server listening on its default port 8090.

The keystore password is stored in clear text

settings.conf now holds a secret. Make sure the file is only readable by the account running Drovio Server.
Restart the Drovio Server service. Unlike most of the configuration, everything that defines the HTTP listener is read once at startup, so a restart is required here. See Start and stop the service for your platform.
Check the result, from another machine:
```
openssl s_client -connect your_hostname:443 -showcerts </dev/null
```
The output must show your certificate and the intermediary certificate. A missing intermediary is the most common mistake: some browsers will still accept the connection while the Drovio app refuses it.

Renewing the certificate¶

The keystore holds a copy of the certificate, not a reference to it, so a renewed certificate has to be imported again: replay step 2 every time, which happens every 90 days with Let's Encrypt.

On Linux, send SIGUSR2 to Drovio Server to apply it: the keystore is reloaded from disk and the certificate is swapped on the live listener, without dropping a single connection:

systemctl kill --signal=SIGUSR2 drovio-server

The log line SSL certificate has been reloaded confirms it. A failure is reported as SSL certificate reloading has failed, and the previous certificate stays in use.

Scripting the renewal

This makes the renewal fully automatable: have your ACME client run step 2 in its deploy hook, then send the signal. No restart, no maintenance window.

Windows

Signals are not registered on Windows. There, applying a renewed certificate requires restarting the service.

Protocols and cipher suites¶

TLS 1.2 and TLS 1.3 are enabled by default. To restrict them, or to pin a list of cipher suites, use http.tls_protocols and http.tls_cipher_suites.