Configuring HTTPS

Secure GlobalForms with HTTPS so that sign-ins and form data are encrypted between browsers and the server.

How HTTPS works in GlobalForms

• GlobalForms always listens for HTTP on port 3001.

• When it finds a valid certificate and private key, it also listens for HTTPS on port 5454.

• By default it looks for the certificate at ssl\server.crt and the key at ssl\server.key in the install folder. You can point to other files in config\local.json.

• The ssl folder and local.json are kept during updates, so you only set this up once.

Before you begin

• Get a certificate for the host name users will use, for example forms.example.com, from your certificate authority. You need:

  • The certificate in PEM format (a text file that begins with -----BEGIN CERTIFICATE-----, often named .crt or .pem). Include any intermediate certificates in the same file, after your server certificate.

  • The private key in PEM format (begins with -----BEGIN and contains PRIVATE KEY, often named .key).

  • The key's password, if the key is encrypted.

• Make sure DNS for that host name points to the GlobalForms server.

• Allow inbound traffic on the HTTPS port (5454 by default) in Windows Firewall and any network firewall.

Option 1: Use the default file names (simplest)

1. Rename your certificate file to server.crt and your key file to server.key.

2. Copy both files into the ssl folder in the install folder (C:\GlobalForms\ssl by default). Create the folder if it does not exist.

3. If the key is encrypted, add its password to config\local.json:

   JSON

   {
     "ssl": {
       "certPassword": "<Key password>"
     }
   }
   

4. Set domain in config\local.json to the HTTPS address users will use (see below).

5. Restart the GlobalForms service.

Option 2: Point to certificate files in another location

1. Place the certificate and key files in a folder that the GlobalForms service can read, for example C:\Certificates\GlobalForms.

2. Add their locations to config\local.json. Write each backslash twice:

   JSON

   {
     "ssl": {
       "certPath": "C:\\Certificates\\GlobalForms\\forms.example.com.crt",
       "keyPath": "C:\\Certificates\\GlobalForms\\forms.example.com.key",
       "certPassword": ""
     }
   }
   

3. Set domain to the HTTPS address (see below).

4. Restart the GlobalForms service.

You can also enter the certificate path, key path and password at the setup prompts when you install GlobalForms.

Set the server address and port

Update domain so it matches the HTTPS address users will use. To use the standard HTTPS port 443 instead of 5454, also change sslPort:

{
  "domain": "https://forms.example.com",
  "sslPort": 443
}

Verify HTTPS

1. In a browser, open your HTTPS address, for example https://forms.example.com:5454.

2. Confirm the browser shows a secure connection with no certificate warning.

3. Sign in and open a form to confirm everything loads.

After HTTPS is working

• Give users only the HTTPS address. GlobalForms sends a security header that tells browsers to keep using HTTPS for this host name, so browsers may refuse plain HTTP links to the same name after the first secure visit.

• Update any links, bookmarks or integrations that point to the HTTP address, including GlobalCapture and any single sign-on redirect URLs.

• Block the HTTP port (3001) at the firewall if nothing needs it.

Testing with a self-signed certificate

For a test server only, you can create a self-signed certificate. Browsers show a warning for self-signed certificates, so do not use one in production.

1. Install OpenSSL for Windows. The script looks for openssl on the PATH or in C:\Program Files\OpenSSL-Win64.

2. In PowerShell as administrator, run the following from the install folder:

   PowerShell

   cd C:\GlobalForms
   node scripts\generate-ssl-cert.js --domain https://forms.example.com
   

   This creates ssl\server.crt and ssl\server.key.

3. Restart the GlobalForms service.

Renewing a certificate

Replace the certificate and key files with the renewed ones, keeping the same names and locations, then restart the GlobalForms service.

Troubleshooting

Related pages

• Configuration Files

• Ports and External Access

• Security Headers

• System Requirements