Certificates

A certificate is used to secure the connection to the server. It confirms the origin of the received data and carries the public key for encrypting the data with it.

Certificate Status

A certificate expires after a certain period of time. Antcas Control therefore renews these before they expire. The current status is displayed at the bottom right in the editor. If a certificate is only valid for 7 days or less, a warning message is also displayed in the visualization.

Functionality and Example

The certificate is always resolved to an FQDN (Fully Qualified Domain Name or full name of a domain). For this purpose, it is necessary that the IP from the Antcas server must be resolved via a DNS server. This can either be done within your own network or via a public address. See DNS and Port Forwarding.

  1. Address https://home.my.antcas.com:8000/ is retrieved
  2. The FQDN home.my.antcas.com is transmitted to the DNS server of the host. The servers are usually provided by the DHCP server in the network but can also be configured manually.
  3. The address has been stored on the DNS server:
    1. The configured internal IP address is returned
  4. The address is unknown:
    1. The next public DNS server (also called nameserver) is searched for the FQDN
    2. The request goes via public DNS server to my.antcas.com, which then returns the last known public IP address. If it is a domain other than antcas.com, the DynDNS or DNS service provider is searched for the FQDN.
  5. After the IP has been transmitted to the browser, an encrypted TLS connection is established.
  6. After the handshake, the certificate and the origin of the address are checked. The issuer of the certificate must match the entered FQDN.

Note: The address can be resolved both internally and externally. That is, in a local network connection, the connection is established directly. With this method, communication continues to function even during an internet outage.

Configuration

All settings can be found in the Infrastructure. A certificate always applies to the FQDN. This is configured by the Server-Hostname and the individual Network Interfaces under Advanced.

Note: If a new certificate is installed, the browser may need to be restarted to display it correctly.

Cloud Certificate

If the FQDN ends with .my.antcas.com, the certificate is automatically downloaded from Antcas Hub. With this method, no specific router configuration is required. The preceding name can be chosen freely.

Note: If a DynDNS service is used, ensure that the hostname matches the address of the service.

External Certificates

To use an external certificate, it can be uploaded in the Infrastructure under Certificates in the folder External. An own certificate has higher priority than all other methods. If this expires, however, other methods are automatically used.

The uploaded certificate must be in PEM format and must include both the private key and the certificate. If this is not the case, they can be merged using a text editor. The order does not need to be observed. It must be ensured that there is a line break between the parts. Additionally, it is important that one domain (CN) is present in the subject.

Certificate from Let's Encrypt or ZeroSSL

If none of the above methods are used and the name includes a TLD, an attempt will be made to request a certificate. For this purpose, the entered name must be registered with a public DNS server.

Additionally, port 80 on the server must be accessible from the outside. If multiple servers use this method, an ACME relay can be set up. This is described further below.

After approximately 2 to 5 minutes, the valid certificate should have been installed. If an error occurs, the process can be repeated by clicking on Certificate on Renew.

Note: Too many repetitions can lead to a temporary block. Wait a moment before repeating the process.

No Certificate

If it is not possible to create an certificate, one will be generated by the server. However, this should never be used for productive environments.

ACME Relay

The ACME relay is used to provide multiple servers with an SSL certificate from Let's Encrypt or ZeroSSL. For this purpose, the TCP port 80 is forwarded.

Enter each IP address or respective hostname on a separate line for this purpose.

Warning: This is not a proxy application and should only be used for certificates.