Skip to main content

Configuring HTTPS (Linux w/ Docker)

We strongly recommend serving Informer over HTTPS. As of Informer 5.0.13, HTTPS is applied through the Informer Load Balancer, which avoids the performance degradation of the older method. Set up the Load Balancer first, then follow this article.

Applies to 2025.2 and later

These steps are for Informer 2025.2 and later. For 2025.1 and earlier, contact Support for the archived procedure.

Why HTTPS matters​

A lot of potentially sensitive information flows between users' browsers and the Informer server. HTTPS protects it with:

  • End-to-end encryption: data between Informer and users' machines is encrypted, so even on a compromised network an attacker cannot read it.
  • Host validation: the client validates the certificate the server presents, so as long as users go to the correct address and see the HTTPS lock indicator, an attacker cannot impersonate Informer.

Prerequisites​

  • Informer 5.0.13 or higher.
  • An X.509 SSL certificate in PEM format for the server (wildcard certificates are fine) and the matching private key in unencrypted PEM format.
  • Alternatively, an encrypted PFX file containing both the certificate and private key, plus the PFX passphrase.

Configure HTTPS​

  1. Stop the Docker containers:

    docker-compose stop

  2. Set up the Load Balancer if it is not already configured.

  3. Edit docker-compose.yml and make sure the load balancer has a volume pointing to where the certificate will live. The directory names do not have to match this example:

    i5-load-balancer:
      image: docker.entrinsik.com:5000/i5-load-balancer
      working_dir: /i5-load-balancer
      ports:
        - "80:80"
        - "443:443"
      volumes:
        - ./config.json:/i5-load-balancer/config.json
        - ./ssl/certs:/i5-load-balancer/etc

  4. Edit config.json and add a tls section. The path is the directory inside the container (here /i5-load-balancer/etc, matching the volume above), not the host path. The extension does not have to be .pem.

    For a certificate/key pair:

    "tls": {
      "cert": "/i5-load-balancer/etc/cert.pem",
      "key": "/i5-load-balancer/etc/key.pem"
    },
    "http": 80,
    "https": 443,

    For a PFX file with a passphrase:

    "tls": {
      "pfx": "/i5-load-balancer/etc/cert.pfx",
      "passphrase": "YourPassphraseGoesHere"
    },
    "http": 80,
    "https": 443,

    A completed config.json looks similar to this (the rules may differ based on your load-balancer configuration):

    {
      "tls": {
        "pfx": "/i5-load-balancer/etc/cert.pfx",
        "passphrase": "YourPassphraseGoesHere"
      },
      "http": 80,
      "https": 443,
      "host": "informer5.myServer.com",
      "loadBalancer": {
        "rules": [
          { "regex": ".*\\/jobs\\/[^\\/]*$", "url": "http://informer-schedules" },
          { "regex": ".*_(query|run|refresh)+", "url": "http://informer-query" },
          { "regex": "$", "url": "http://informer" }
        ]
      }
    }

  5. If you are adding HTTPS after Informer was first started, delete the existing Informer and load-balancer containers so the docker-compose.yml changes take effect (the names may differ from your local file):

    docker-compose rm informer-api
    docker-compose rm informer-query
    docker-compose rm informer-schedules
    docker-compose rm i5-load-balancer

  6. Start the containers:

    docker-compose up -d

Informer should now be reachable over HTTPS.

Self-signed certificates​

For a certificate/key pair, only the server certificate is in the trust chain by default. To add the root and intermediate certificates:

  1. Obtain the X.509 raw base-64 version of the root and intermediate certificates.
  2. Open the certificate files.
  3. Copy their full contents, omitting any whitespace.
  4. Concatenate them onto the server certificate Informer uses for TLS.
  5. Save the combined file containing the server, root, and intermediate certificates.
  6. Stop and restart Informer to pick up the change.

Verify the full trust chain by browsing to Informer and inspecting the site certificate (the padlock in the address bar).

Optional hardening​

You can add security headers to Informer's config.json under the ./modules/deployer plugin to harden browser access.

HTTP Strict Transport Security (HSTS) tells browsers to always use HTTPS for Informer and to upgrade any HTTP attempt automatically:

"plugins": {
  "./modules/deployer": {
    "headers": {
      "Strict-Transport-Security": "max-age=31536000"
    }
  }
}

Preventing clickjacking stops Informer from being framed by another site. Replace <InformerURL> with your Informer access URL, for example https://myInformer.com:

"plugins": {
  "./modules/deployer": {
    "headers": {
      "x-frame-options": "sameorigin",
      "content-security-policy": "frame-ancestors 'self' <InformerURL>"
    }
  }
}