# Self-signed certificates

**URL:** <https://discourse.openondemand.org/t/self-signed-certificates/2509>\
**Category:** Get Help\
**Tags:** ondemand2, question\
**Created:** [February 28, 2023, 8:57pm UTC](https://discourse.openondemand.org/t/self-signed-certificates/2509 "2023-02-28T20:57:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![davide-q](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/davide-q/32/1510_2.png) [@davide-q](https://discourse.openondemand.org/u/davide-q)\
**Post date:** [February 28, 2023, 8:57pm UTC](https://discourse.openondemand.org/t/self-signed-certificates/2509/1 "2023-02-28T20:57:47Z")

</div>

I’ve installed a pretty vanilla version of OnDemand v2, the only thing that I changed from default is that I configured SSL with self-signed certificate. I can’t use a non-self-signed certificate since this machine does not have a DNS record, just an IP address.

The error logs report `TLS handshake error from xxxx remote error: tls: unknown certificate authority` and the browser returns 404 for everything but the `.well-known/openid-configuration`

Is there a way to have it work with self-signed certificates, or do I need to fall on unencrypted connection?

---

<div class="post-metadata">

**Author:** ![travert](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/travert/32/3074_2.png) [@travert](https://discourse.openondemand.org/u/travert)\
**Post date:** [February 28, 2023, 10:44pm UTC](https://discourse.openondemand.org/t/self-signed-certificates/2509/2 "2023-02-28T22:44:02Z")

</div>

Hello and welcome!

Using a self-signed cert should still work fine. What does the `ssl` option in your `ood_portal.yml` look like?

---

<div class="post-metadata">

**Author:** ![davide-q](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/davide-q/32/1510_2.png) [@davide-q](https://discourse.openondemand.org/u/davide-q)\
**Post date:** [February 28, 2023, 11:13pm UTC](https://discourse.openondemand.org/t/self-signed-certificates/2509/3 "2023-02-28T23:13:41Z")

</div>

Thanks for the answer. My config file is simply like this:

```auto
 grep -v '^#' /etc/ood/config/ood_portal.yml | grep -v '^ *$'
---
port: 8443
ssl:
  - 'SSLCertificateFile "/etc/pki/tls/certs/localhost.crt"'
  - 'SSLCertificateKeyFile "/etc/pki/tls/private/localhost.key"'
auth:
  - 'AuthType Basic'
  - 'Require valid-user'

```

and the certificates are

```auto
ls -l /etc/pki/tls/certs/localhost.crt /etc/pki/tls/private/localhost.key
-rw-r--r-- 1 root root 3834 Jan 11 2022 /etc/pki/tls/certs/localhost.crt
-rw------- 1 root root 1704 Jan 11 2022 /etc/pki/tls/private/localhost.key

```

I also tried without changing auth from default, which I think implies OpenID which failed because it is not configured in my Apache – I eventually will want to get it working with LDAP but one step at the time

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [August 27, 2023, 11:14pm UTC](https://discourse.openondemand.org/t/self-signed-certificates/2509/4 "2023-08-27T23:14:20Z")

</div>

Closed on August 27, 2023, 11:14pm UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.