Certificates

A certificate is used to secure the connection to the server. It confirms the origin of the received data and carries the public key for encrypting the data with it.

Certificate Status

A certificate expires after a certain time. Therefore, Antcas Control renews it before it expires. The current status is displayed at the bottom right in the editor. If a certificate is valid for only 7 days or less, a warning message is also displayed in the visualization.

Operation and Example

The certificate is always resolved to an FQDN (Fully Qualified Domain Name or full name of a domain). For this purpose, it is necessary that the IP from the Antcas server must be resolved via a DNS server. This can either be done within your own network or via a public address. See DNS and Port Forwarding.

  1. Address https://home.my.antcas.com:8000/ is retrieved
  2. The FQDN home.my.antcas.com is transmitted to the DNS server of the host. The servers are usually provided by the DHCP server in the network but can also be configured manually.
  3. The address has been stored on the DNS server:
    1. The configured internal IP address is returned
  4. The address is unknown:
    1. The next public DNS server (also called nameserver) is searched for the FQDN
    2. The request goes via public DNS server to my.antcas.com, which then returns the last known public IP address. If it is a domain other than antcas.com, the DynDNS or DNS service provider is searched for the FQDN.
  5. After the IP has been transmitted to the browser, an encrypted TLS connection is established.
  6. After the handshake, the certificate and the origin of the address are checked. The issuer of the certificate must match the entered FQDN.

Note: The address can be resolved both internally and externally. That is, in a local network connection, the connection is established directly. With this method, communication continues to function even during an internet outage.

Configuration

All settings can be found in the Infrastructure. A certificate always applies to the FQDN. This is configured by the Server-Hostname and the individual Network Interfaces under Advanced.

Note: If a new certificate is installed, the browser may need to be restarted to display it correctly.

Cloud Certificate

If the FQDN ends with .my.antcas.com, the certificate is automatically downloaded by Antcas Hub. With this method, no specific router configuration is necessary. The preceding name can be chosen freely.

Note: If a DynDNS service is used, ensure that the hostname matches the address of the service.

External Certificates

To use an external certificate, it can be uploaded in the Infrastructure under Certificates in the folder External. An own certificate has higher priority than all other methods. If this expires, however, other methods are used automatically.

The uploaded certificate must be in PEM format and must include the private key and the certificate at the same time. If this is not the case, they can be merged using a text editor. The order does not need to be considered. It must be ensured that there is a line break between the parts. Furthermore, it is important that one domain (CN) is in the subject.

Certificate from Let's Encrypt or ZeroSSL

If none of the methods described above are used and the name contains a TLD, an attempt is made to request a certificate. For this purpose, the entered name must be entered in a public DNS server.

In addition, port 80 on the server must be accessible from the outside. If multiple servers use this method, an ACME relay can be set up. This is described further below.

After about 2 to 5 minutes, the valid certificate should now have been installed. If an error occurs, the process can be repeated if Renew is pressed in the Certificate.

Note: Too many repetitions can lead to a temporary block. Wait a moment before repeating the process.

No Certificate

If it is not possible to create an certificate, one is generated by the server itself. However, this should never be used for productive environments.

ACME Relay

The ACME relay is used to provide multiple servers with an SSL certificate from Let's Encrypt or ZeroSSL. For this purpose, the TCP port 80 is forwarded.

To do this, enter each IP address or the respective hostname per line.

Warning: This is not a proxy application and should only be used for certificates.