Skip to main content

TLS with Docker

note

For Kubernetes installations, follow the instructions on the page Deploy using Kubernetes to setup TLS.

It is highly recommended to configure TLS for the Analysis Hub frontend, to secure traffic between the browser and the server. TLS can be configured by either:

  • Using automated issuance and renewal of certificates from Let's Encrypt
  • Using self-issued certificates

Use Let's Encrypt​

To automatically issue certificates using Let's Encrypt, set ANALYSISHUB_AUTOCERT_ENABLED to true.

The Analysis Hub must be able to respond to challenges from the Let's Encrypt validation servers to validate that the used domain name is in your control, as defined by the ACME standard.

To respond to the ACME challenges, either port 80 (for http-01 challenges) or 443 (for tls-alpn-01 challenges) must be publicly accessible for the validations servers of Let's Encrypt.

info

If you're unsure, go with HTTP-01.

Configure autocert with HTTP-01 challenge​

note

This option is most suitable when port 443 should be restricted, and port 80 can be publicly exposed.

To allow the Analysis Hub to respond to HTTP-01 challenges:

  • Port 80 should be publicly accessible for Let's Encrypt validation servers.
  • ANALYSISHUB_AUTOCERT_HTTP01_ENABLED should be set to true.

Port 80 will solely expose a simple challenge response server for domain name validation, and redirects all other traffic to the secure port 443.

Configure autocert with TLS-ALPN-01 challenge​

note

This option is most suitable when port 443 is publicly exposed.

To allow the Analysis Hub to respond to TLS-ALPN-01 challenges:

  • Port 443 should be publicly accessible for Let's Encrypt validation servers.
  • ANALYSISHUB_AUTOCERT_HTTP01_ENABLED should be set to false.

Servers without internet access​

Automatic certificate issuance requires the Analysis Hub to reach the Let's Encrypt ACME endpoints, and the Let's Encrypt validation servers to reach the Analysis Hub to answer the challenge. Neither is part of the required connections, so on a server that is restricted to those connections, leave ANALYSISHUB_AUTOCERT_ENABLED disabled and either:

  • provide your own certificate, as described under Use self-issued certificates, or
  • terminate TLS on a reverse proxy in front of the Analysis Hub and leave ANALYSISHUB_FRONTEND_TLS_CERTFILE and ANALYSISHUB_FRONTEND_TLS_KEYFILE empty.

Use self-issued certificates​

To use self-issued certificates, set ANALYSISHUB_FRONTEND_TLS_CERTFILE and ANALYSISHUB_FRONTEND_TLS_KEYFILE to the location of the certificate files.

More detailed instructions can be found in Optional variables table of the Docker installation page.