Help Search

Manual HTTPS configuration on Debian and Ubuntu with user provided certificates

If you are changing your domain from HTTP to HTTPS, you will unlink the browser extension of all the users. Before changing the domain, you must ensure that all the users have a copy of their private key to recover their account.

Passbolt debian and ubuntu packages currently supports the configuration of nginx. It comes with a default configuration that supports:

  • Serve passbolt on port 80 (http)
  • Serve passbolt on port 443 (https)

On this context ‘manually’ means that the user will provide the SSL certificates, this is the main difference with the ‘auto’ method where Let’s Encrypt will issue the SSL certificate for you.

This manual method is often useful on private network installations with private CA where the system admin issues a new private SSL certificate and uploads it to the passbolt server. It is also a method often used with self-signed SSL certificates for test installations.

On this example we will assume the user is generating a self-signed certificate on the passbolt server.

Generate the SSL certificate

While connected to your passbolt instance you can generate a SSL certificate in the following way:

openssl req -x509 \
    -newkey rsa:4096 \
    -days 120 \
    -subj "/C=LU/ST=Luxembourg/L=Esch-Sur-Alzette/O=Passbolt SA/OU=Passbolt IT Team/CN=passbolt.domain.tld/" \
    -nodes \
    -addext "subjectAltName = DNS:passbolt.domain.tld" \
    -keyout key.pem \
    -out cert.pem

This command will output two files: key.pem and cert.pem. Identify the absolute path where these files are located as you will need them in next steps.

Of course, replace -subj values with your own. It is important to set your passbolt FQDN in both CN and subjectAltName. In this way, you will be able to import the generated certificate in your operating system keychain and make your self-signed domain trusted in your browser.

Pro tip: You can use an IP address instead of a domain name for your self-signed certificate. If you do that, replace DNS with IP in subjectAltName.

Install or reconfigure passbolt

If you don’t have passbolt installed please check on the hosting section for more information on how to install passbolt on debian.

If you have already installed passbolt then you want to execute the following command to start the configuration process for SSL:

sudo dpkg-reconfigure passbolt-ce-server

You most likely want to say ‘NO’ to the mariadb/mysql setup question and go for the nginx setup

You should select yes for the nginx setup:

Nginx configuration message fig. Nginx configuration message

Choose ‘manual’ for the SSL setup method:

SSL method selection fig. SSL method selection

Provide the domain name you plan to use for your passbolt server. On this example and as we are using a self-signed certificate the domain name is not as important as if you are planning to use a proper SSL certificate. In the later escenario DNS domain name and SSL domain name must match.

Domain for nginx setup fig. Domain for nginx setup

Provide the full path of the SSL certificate you created on previous steps (‘cert.pem’)

SSL certificate path fig. SSL certificate path

Now provide the full path of the SSL key (‘key.pem’)

SSL private key path fig. SSL private key path

Keep in mind that you might need to add DNS records to reach your domain on your local network or in a public DNS provider.

Success message fig. Success message

Reload nginx after finish the reconfigure to use the SSL configuration.

sudo systemctl reload nginx

Finally, ensure ‘fullBaseUrl’ value in /etc/passbolt/passbolt.php starts with https://.

And that’s it you should be able to reach your server on the domain you specified.

Last updated

This article was last updated on December 16th, 2021.

Are you experiencing issues when installing passbolt?

Ask the community!
🍪   Do you accept cookies for statistical purposes? (Read more) Accept No thanks!