<p>As stated here: <a href="https://nxtforum.org/public-nodes-vpss/method-to-configure-https-for-nxt-public-nodes/" rel="nofollow noreferrer">https://nxtforum.org/public-nodes-vpss/method-to-configure-https-for-nxt-public-nodes/</a></p>

<pre><code>Requirements

1) A Linux server running Nxt, and configured for public API access. This should only require creating a nxt.properties under nxt/conf similar to this:

nxt.apiServerCORS=true
nxt.uiServerCORS=true
nxt.myAddress=SERVER_IP_ADDRESS
nxt.allowedBotHosts=*
nxt.allowedUserHosts=127.0.0.1; localhost; SERVER_IP_ADDRESS; 0:0:0:0:0:0:0:1;
nxt.enableAPIserver=true
nxt.apiServerHost=0.0.0.0

2) A subdomain (or domain) to access your node. This is required to use an SSL certificate. The subdomain should be included in the domain nameservers configuration as an A record pointing to your server IP.


Procedure

In this example, setup was done using root account. If you're using a non-root account, it needs to be in the sudo group and commands need to be run using sudo.

1) *Turn off Apache if you have it installed already first* Install letsencrypt (certbot) and generate the SSL certificate for your (sub)domain.

wget https://dl.eff.org/certbot-auto
chmod a+x ./certbot-auto
./certbot-auto certonly --standalone --email admin@example.com -d sub.example.com

2) Install apache webserver if you dont have it already and enable the modules for ssl and reverse proxy. If you have it installed, just enable proxy_http

apt-get install apache2
a2enmod ssl proxy_http

3) Configure the default apache configuration file.

nano /etc/apache2/sites-available/000-default.conf

Replace the default configuration lines with the following, replacing the strings in red with your (sub)domain. Just comment out the existing one and copy the entire thing below and adjust to your site/directories:

&lt;VirtualHost *:80&gt;
        ServerName sub.example.com
        Redirect permanent / https://sub.example.com/
&lt;/VirtualHost&gt;
&lt;IfModule mod_ssl.c&gt;
&lt;VirtualHost *:443&gt;
        ServerName sub.example.com
        SSLEngine on
        SSLCertificateFile /etc/letsencrypt/live/sub.example.com/cert.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/sub.example.com/privkey.pem
        SSLCertificateChainFile /etc/letsencrypt/live/sub.example.com/chain.pem
        SSLProxyEngine On
        ProxyPreserveHost On
        ProxyRequests Off
        ProxyPass / http://localhost:7876/
        ProxyPassReverse / http://localhost:7876/
&lt;/VirtualHost&gt;
&lt;/IfModule&gt;

4) Finally, restart the apache webserver.

service apache2 restart
</code></pre>

<p>If you run into 404 errors during install, you'll have to remove those packages like this: <a href="https://askubuntu.com/questions/896603/trying-to-install-letsencrypt-on-ubuntu-12-04-using-certbot-auto-program-but-ge/896614#896614">https://askubuntu.com/questions/896603/trying-to-install-letsencrypt-on-ubuntu-12-04-using-certbot-auto-program-but-ge/896614#896614</a></p>

<p>Remember to change your port if your going to use testnet 6876 or mainnet 7876.</p>

<p>Also be sure to open up your ports 7874 for peer connetions.</p>

<p>Ardor ports are testnet <em>26876</em> and live <em>27876</em></p>

<hr>

<p>The above also works when making a public Ardor node. </p>

<p>Below is the output after a successful certbot-auto download: </p>

<p><em>MAKE SURE YOU TURN OFF APACHE BEFORE YOU DO THIS</em></p>

<hr>

<pre><code>root@localh:~# ./certbot-auto certonly --standalone --email info@xxxx.com -d ardor.xxxxx.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for ardor.xxxx.com
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/ardor.xxxx.com/fullchain.pem. Your
   cert will expire on 2017-09-20. To obtain a new or tweaked version
   of this certificate in the future, simply run certbot-auto again.
   To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le
</code></pre>

CC BY-SA 3.0
2017-06-22T02:55:14.760Z
Tried this again with Ardor 2.0.3e and ran into some issues on my ubuntu server. I had apache installed and running already. When running certbot-auto it would error out at *ERROR BINDING TO PORT 443* . Reason is because apache was still on. Make sure you turn it off first. Overall this is a very easy setup, max 10 minutes if everything goes smoothly.
Patoshi パトシ
CC BY-SA 3.0
2017-06-24T21:26:59.343Z
To renew your SSL cert just find the letscrypt command and just do a *./letsencrypt renew* -- See: https://pastebin.com/jAUJZLwT
Patoshi パトシ
CC BY-SA 3.0
2017-08-09T16:45:27.370Z
Ran into another issue with a keystore issue. Check your nxt.properties and delete your keystore line.
Patoshi パトシ
CC BY-SA 3.0
2017-09-14T16:05:27.210Z
updated again smoothly: http://prntscr.com/gl57qv
Patoshi パトシ
CC BY-SA 4.0
2018-08-18T23:25:41.290Z
For this to work for me with an Ardor node (without typing in the port manually each visit) I had to set 
`ProxyPass / http://localhost:27876/
ProxyPassReverse / http://localhost:27876/` 
to 
`ProxyPass / https://localhost:27876/
ProxyPassReverse / https://localhost:27876/` notice https instead of http. But other than that, great answer!
Will Tate
CC BY-SA 3.0
2017-03-25T19:06:23.297Z
2017-06-22T02:49:47.883Z
2017-06-22T02:49:47.883Z
Patoshi パトシ
<p>I want to run my own public nxt / ardor node, but I also want https (letsencrypt). I have a ubuntu server with apache 2.4 installed already. What are the steps to get this setup? </p>

<nxt><ardor>
How to setup https ssl letsencrypt for NXT / Ardor public nodes?
Patoshi パトシ
# How to setup https ssl letsencrypt for NXT / Ardor public nodes?

(Asked by: username_0 on 2017-03-25)

I want to run my own public nxt / ardor node, but I also want https (letsencrypt). I have a ubuntu server with apache 2.4 installed already. What are the steps to get this setup?

**Tags:** nxt, ardor


---

## 1 answers

### Answer by username_0 on 2017-03-25. Score: 3 | Accepted answer

As stated here: <https://nxtforum.org/public-nodes-vpss/method-to-configure-https-for-nxt-public-nodes/>

```
Requirements

1) A Linux server running Nxt, and configured for public API access. This should only require creating a nxt.properties under nxt/conf similar to this:

nxt.apiServerCORS=true
nxt.uiServerCORS=true
nxt.myAddress=SERVER_IP_ADDRESS
nxt.allowedBotHosts=*
nxt.allowedUserHosts=127.0.0.1; localhost; SERVER_IP_ADDRESS; 0:0:0:0:0:0:0:1;
nxt.enableAPIserver=true
nxt.apiServerHost=0.0.0.0

2) A subdomain (or domain) to access your node. This is required to use an SSL certificate. The subdomain should be included in the domain nameservers configuration as an A record pointing to your server IP.

Procedure

In this example, setup was done using root account. If you're using a non-root account, it needs to be in the sudo group and commands need to be run using sudo.

1) *Turn off Apache if you have it installed already first* Install letsencrypt (certbot) and generate the SSL certificate for your (sub)domain.

wget https://dl.eff.org/certbot-auto
chmod a+x ./certbot-auto
./certbot-auto certonly --standalone --email admin@example.com -d sub.example.com

2) Install apache webserver if you dont have it already and enable the modules for ssl and reverse proxy. If you have it installed, just enable proxy_http

apt-get install apache2
a2enmod ssl proxy_http

3) Configure the default apache configuration file.

nano /etc/apache2/sites-available/000-default.conf

Replace the default configuration lines with the following, replacing the strings in red with your (sub)domain. Just comment out the existing one and copy the entire thing below and adjust to your site/directories:

<VirtualHost *:80>
        ServerName sub.example.com
        Redirect permanent / https://sub.example.com/
</VirtualHost>
<IfModule mod_ssl.c>
<VirtualHost *:443>
        ServerName sub.example.com
        SSLEngine on
        SSLCertificateFile /etc/letsencrypt/live/sub.example.com/cert.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/sub.example.com/privkey.pem
        SSLCertificateChainFile /etc/letsencrypt/live/sub.example.com/chain.pem
        SSLProxyEngine On
        ProxyPreserveHost On
        ProxyRequests Off
        ProxyPass / http://localhost:7876/
        ProxyPassReverse / http://localhost:7876/
</VirtualHost>
</IfModule>

4) Finally, restart the apache webserver.

service apache2 restart

```

If you run into 404 errors during install, you'll have to remove those packages like this: <https://askubuntu.com/questions/896603/trying-to-install-letsencrypt-on-ubuntu-12-04-using-certbot-auto-program-but-ge/896614#896614>

Remember to change your port if your going to use testnet 6876 or mainnet 7876.

Also be sure to open up your ports 7874 for peer connetions.

Ardor ports are testnet *26876* and live *27876*

---

The above also works when making a public Ardor node.

Below is the output after a successful certbot-auto download:

*MAKE SURE YOU TURN OFF APACHE BEFORE YOU DO THIS*

---

```
root@localh:~# ./certbot-auto certonly --standalone --email info@xxxx.com -d ardor.xxxxx.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for ardor.xxxx.com
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/ardor.xxxx.com/fullchain.pem. Your
   cert username_1 expire on 2017-09-20. To obtain a new or tweaked version
   of this certificate in the future, simply run certbot-auto again.
   To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

```

> **Comments:**
> **username_0**: Tried this again with Ardor 2.0.3e and ran into some issues on my ubuntu server. I had apache installed and running already. When running certbot-auto it would error out at *ERROR BINDING TO PORT 443* . Reason is because apache was still on. Make sure you turn it off first. Overall this is a very easy setup, max 10 minutes if everything goes smoothly.  
> **username_0**: To renew your SSL cert just find the letscrypt command and just do a *./letsencrypt renew* -- See: https://pastebin.com/jAUJZLwT  
> **username_0**: Ran into another issue with a keystore issue. Check your nxt.properties and delete your keystore line.  
> **username_0**: updated again smoothly: http://prntscr.com/gl57qv  
> **username_1**: For this to work for me with an Ardor node (without typing in the port manually each visit) I had to set  `ProxyPass / http://localhost:27876/ ProxyPassReverse / http://localhost:27876/`  to  `ProxyPass / https://localhost:27876/ ProxyPassReverse / https://localhost:27876/` notice https instead of http. But other than that, great answer!  

---

