> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/installation/rpm/rpm-single-node/enable-https.md).

# Enable HTTPS

Put your own certificate in front of the deployment and serve it over HTTPS.

The deployment starts on HTTP so you can confirm it works before certificates are involved. This page puts your certificate in front of it.

Two approaches, and both are supported:

* **Terminate TLS at your own load balancer or reverse proxy** and forward to the deployment. Usually simpler where such infrastructure exists, and it keeps certificate renewal where your organisation already manages it.
* **Configure the bundled proxy** with your certificate, covered below.

## What this covers, and how long it takes

<table><thead><tr><th width="165.99998474121094"></th><th></th></tr></thead><tbody><tr><td><strong>You get</strong></td><td>The console and all user interfaces served over HTTPS on port 443</td></tr><tr><td><strong>Time</strong></td><td>20 minutes</td></tr><tr><td><strong>Hosts</strong></td><td>The host running the reverse proxy</td></tr><tr><td><strong>Downtime</strong></td><td>A few seconds while the proxy restarts</td></tr><tr><td><strong>Reversible</strong></td><td>Yes — the HTTP configuration is kept</td></tr></tbody></table>

## Before you start

* A server certificate, its private key, and the CA chain, for the hostname users will type.
* The deployment passing [*Start and verify*](/installation/rpm/rpm-single-node/start-and-verify.md).

## Set these first

{% code overflow="wrap" %}

```bash
export OPENIAM_URL=<the address users will type>
export CERT_FILE=<path to your certificate>
export KEY_FILE=<path to its private key>
export CHAIN_FILE=<path to the intermediate chain, if you have one>
```

{% endcode %}

***

## Build it

### 1. Place the certificate and key

Use the standard system locations. **SELinux expects them here**, and putting them elsewhere means relabelling:

{% code overflow="wrap" %}

```bash
cp "$CERT_FILE"  /etc/pki/tls/certs/openiam.crt
cp "$CHAIN_FILE" /etc/pki/tls/certs/openiam-chain.crt
cp "$KEY_FILE"   /etc/pki/tls/private/openiam.key
chmod 600 /etc/pki/tls/private/openiam.key
```

{% endcode %}

### 2. Switch the proxy to the HTTPS configuration

Set the HTTP configurations aside rather than deleting them, so you can return to them:

{% code overflow="wrap" %}

```bash
cd /etc/httpd/conf.d/
# the installation has usually already renamed this to ssl.conf.off
mv ssl.conf ssl.conf.off 2>/dev/null || true
mv mod_openiam.conf mod_openiam.conf_not_used
cp /usr/share/doc/mod_openiam*/conf.d/mod_openiam_ssl.conf /etc/httpd/conf.d/
```

{% endcode %}

### 3. Point it at your certificate

Edit `/etc/httpd/conf.d/mod_openiam_ssl.conf`:

{% code overflow="wrap" %}

```apache
SSLCertificateFile      /etc/pki/tls/certs/openiam.crt
SSLCertificateKeyFile   /etc/pki/tls/private/openiam.key
SSLCACertificateFile    /etc/pki/tls/certs/openiam-chain.crt
```

{% endcode %}

Confirm `OPENIAM_ESBPath` and `OPENIAM_ConfigureBackend` carry the same values as the HTTP configuration did — see [*Configure the reverse proxy*](/installation/rpm/rpm-single-node/configure-the-reverse-proxy.md).

### 4. Open port 443

{% code overflow="wrap" %}

```bash
firewall-cmd --permanent --add-port=443/tcp
firewall-cmd --reload
```

{% endcode %}

### 5. Restart the proxy

{% code overflow="wrap" %}

```bash
httpd -t && systemctl restart httpd
```

{% endcode %}

**What you should see:** `Syntax OK`, then the service active.

### 6. Update the content provider

In the Webconsole, open the content provider you created during setup and set **Application supports SSL** to `Yes`. This makes the platform generate `https://` links in email and in federation responses.

### 7. Redirect HTTP to HTTPS, optionally

To send anyone arriving on port 80 to the secure address, add a redirect configuration in `/etc/httpd/conf.d/` and restart the proxy. A reference example ships in `/usr/share/doc/mod_openiam*/conf.d/`.

***

## Verify it

{% code overflow="wrap" %}

```bash
curl -I https://$OPENIAM_URL/webconsole
```

{% endcode %}

**Expected: `HTTP/1.1 200`, or a redirect to the sign-in page.**

Confirm the chain is complete — this is the check that catches a missing intermediate, which browsers on some platforms accept and others reject:

{% code overflow="wrap" %}

```bash
openssl s_client -connect $OPENIAM_URL:443 -servername $OPENIAM_URL </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates
```

{% endcode %}

Then open the console in a browser and confirm no certificate warning.

## If it goes wrong

| What you see                                | What it means                                                                   | What to do                                                                               |
| ------------------------------------------- | ------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| The proxy will not start                    | Certificate, key or chain path wrong, or the key does not match the certificate | `httpd -t` names the problem; compare the modulus of the certificate and the key         |
| A certificate warning in the browser        | The chain is incomplete, or the name does not match                             | Confirm `SSLCACertificateFile` is set and the certificate covers the hostname users type |
| The page loads but links point at `http://` | The content provider still says SSL is not supported                            | Step 6                                                                                   |
| Permission errors reading the certificate   | The files are outside the standard paths and SELinux is blocking them           | Move them to `/etc/pki/tls/`, or relabel                                                 |

## What this procedure does not cover

Obtaining a certificate, your organisation's certificate lifecycle, and TLS terminated at a load balancer rather than on the host. For a load balancer, terminate there and leave the host serving HTTP behind it — [*Configure the reverse proxy*](/installation/rpm/rpm-single-node/configure-the-reverse-proxy.md) covers the pairing.

## Related

* [*Configure the reverse proxy*](/installation/rpm/rpm-single-node/configure-the-reverse-proxy.md)
* [*Configure*](/installation/rpm/rpm-single-node/configure.md)
* [*Ports*](/installation/rpm/rpm-single-node/ports.md)

*Applies to OpenIAM 2026.8.1.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/installation/rpm/rpm-single-node/enable-https.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.