Configuring HTTPS (Windows)

We strongly recommend serving Informer over HTTPS. As of Informer 5.0.13, HTTPS is applied through the Informer Load Balancer, which avoids the performance degradation of the older method. Set up the Load Balancer first, then follow this article.

Applies to 2025.2 and later

These steps are for Informer 2025.2 and later. For 2025.1 and earlier, contact Support for the archived procedure.

Why HTTPS matters

A lot of potentially sensitive information flows between users' browsers and the Informer server. HTTPS protects it with:

• End-to-end encryption: data between Informer and users' machines is encrypted, so even on a compromised network an attacker cannot read it.
• Host validation: the client validates the certificate the server presents, so as long as users go to the correct address and see the HTTPS lock indicator, an attacker cannot impersonate Informer.

Prerequisites

• Informer 5.0.13 or higher.
• An X.509 SSL certificate in PEM format for the server (wildcard certificates are fine) and the matching private key in unencrypted PEM format.
• Alternatively, an encrypted PFX file containing both the certificate and private key, plus the PFX passphrase.
• OpenSSL on the server (bundled with Informer 5.0.19 and higher), added to the PATH. See OpenSSL on Windows with legacy support.
• Informer CLI 1.0.5 or higher (bundled with Informer 5.0.19 and higher).

Configure HTTPS

1. Stop the Informer service.

2. Set up the Load Balancer if it is not already configured.

3. Place the certificate and key files (or the PFX file) in a directory on the server.

4. Edit config.json and add a tls section. For a certificate/key pair (the extension does not have to be .pem):

   "tls": {
     "cert": "C:\\PATH\\TO\\CERT.PEM",
     "key": "C:\\PATH\\TO\\KEY.PEM"
   },
   "http": "80",
   "https": "443",

   For a PFX file with a passphrase:

   "tls": {
     "pfx": "C:\\PATH\\TO\\CERT.PFX",
     "passphrase": "YourPassphraseGoesHere"
   },
   "http": "80",
   "https": "443",

   Escape special characters in Windows paths

   In Windows paths, escape special characters with a backslash. Both \ and a space are special characters.

   A completed config.json looks similar to this:

   {
     "name": "Informer5",
     "tokenSecret": "this is my token secret",
     "db": {
       "database": "informer5",
       "host": "localhost",
       "user": "i5",
       "password": "informer5",
       "port": 5432
     },
     "elastic": {
       "host": "localhost",
       "port": 9200
     },
     "redis": {
       "host": "localhost",
       "port": 6379
     },
     "NODE_ENV": "production",
     "host": "localhost",
     "tls": {
       "pfx": "C:\\PATH\\TO\\CERT.PFX",
       "passphrase": "YourPassphraseGoesHere"
     },
     "http": "80",
     "https": "443",
     "loadBalancer": {
       "rules": [
         { "regex": ".*\\/jobs\\/[^\\/]*$", "url": "http://localhost:3003" },
         { "regex": ".*_(query|run|refresh)+", "url": "http://localhost:3002" },
         { "regex": "$", "url": "http://localhost:3001" }
       ]
     }
   }

5. Start the Informer service. Informer should now be reachable over HTTPS.

Self-signed certificates

If you need a self-signed certificate and OpenSSL is installed, run the following and answer the prompts. Set the CN (Server Name) to the fully qualified domain name of the server:

openssl req \
  -newkey rsa:2048 -nodes -keyout key.pem \
  -x509 -days 365 -out cert.pem

For a certificate/key pair, only the server certificate is in the trust chain by default. To add the root and intermediate certificates:

1. Obtain the X.509 raw base-64 version of the root and intermediate certificates.
2. Open the certificate files.
3. Copy their full contents, omitting any whitespace.
4. Concatenate them onto the server certificate Informer uses for TLS.
5. Save the combined file containing the server, root, and intermediate certificates.
6. Stop and restart Informer to pick up the change.

Verify the full trust chain by browsing to Informer and inspecting the site certificate (the padlock in the address bar).

Optional hardening

You can add security headers to Informer's config.json under the ./modules/deployer plugin to harden browser access.

HTTP Strict Transport Security (HSTS) tells browsers to always use HTTPS for Informer and to upgrade any HTTP attempt automatically:

"plugins": {
  "./modules/deployer": {
    "headers": {
      "Strict-Transport-Security": "max-age=31536000"
    }
  }
}

Preventing clickjacking stops Informer from being framed by another site. Replace <InformerURL> with your Informer access URL, for example https://myInformer.com:

"plugins": {
  "./modules/deployer": {
    "headers": {
      "x-frame-options": "sameorigin",
      "content-security-policy": "frame-ancestors 'self' <InformerURL>"
    }
  }
}