4.15. HTTP / HTTPS Service

This page describes the configuration options available for the HTTP / HTTPS service.

4.15.1. General description

The HTTP / HTTPS service allows the same level of file access as the other available file transfer services, such as FTPS or SFTP.

When configured for a some.example.com address and the 10080 port, the service will be available at the URL http://some.example.com:10080, and it will redirect users to the start URL http://some.example.com:10080/home/.

As this page focuses on configuration options, please refer to the dedicated HTTP/HTTPS operations page.

4.15.2. Configuration options

Below you can find the list of available configuration options.

Note

SSL-specific options are only available for the HTTPS service type.

Warning

When the ssl_certificate_authority configuration option is enabled, web browsers should include an SSL certificate signed by the same certificate authority.

4.15.3. ssl_certificate

Optional:

Yes

Default value:

no-certificate-defined

Values:

• Path to the SSL certificate file used by the service.

From version:

1.6.0

To version:

None

Description:

The certificate file can contain both the certificate and the private key, in which case you don’t need to set the path to the private key file.

4.15.4. ssl_key

Optional:

Yes

Default value:

Disabled

Values:

• Path to the SSL key file used by the service.
• Disabled - Use the key provided by the certificate file.

From version:

1.6.0

To version:

None

Description:

If the file specified by the ssl_certificate option already contains the private key, this option can be omitted.

4.15.5. ssl_key_password

Optional:

Yes

Default value:

Disabled

Values:

• Password as text.
• Disabled - Don’t use a password for the private key file.

From version:

1.7.19

To version:

None

Description:

This is used when the private SSL key is stored as an encrypted file.

4.15.6. ssl_certificate_authority

Optional:

Yes

Default value:

Disabled

Values:

• Path to the PKI certificate file or folder of PKI certificate authorities.
• Disabled

From version:

1.6.0

To version:

None

Description:

Only clients using certificates signed by one of these certificate authorities will be permitted to connect to this server using secured connections.

The certificate authority file should be stored in PEM format.

Leave it empty or set it as Disabled to disable checking the issuer for peer’s certificates.

When certificate authority check is disabled, connection peers are not required to send a certificate. If the peer sends a certificate, it is ignored.

4.15.7. ssl_certificate_revocation_list

Optional:

Yes

Default value:

Disabled

Values:

• relative path on local filesystem
• absolute path to local filesystem
• http://example.com/some.crl
• file:///unix/absolute/test-ca.crl
• file://unix/relative/test-ca.crl
• file://c:windowsabsolutetest-ca.crl
• file://windowsrelativetest-ca.crl
• comma separated list of CRL locations
• crl-distribution-points
• Disabled

From version:

1.6.0

To version:

None

Description:

It defines the locations from where one or more CRLs will be loaded.

Multiple CRLs are defined as a comma separated list.

It supports local files in both absolute and relative paths.

Retrieving the CRL over HTTP is also supported. The HTTP request is done using non-persistent HTTP/1.1 connections.

CRL distribution points (CDP) are supported by using the crl-distribution-points configuration value.

When CRL distribution points are configured, the server-side certificate defined at ssl_certificate needs to have the CDP extension. The CDP advertised in the server-side certificate is loaded at startup in order to validate the configuration.

The distribution points configuration is mutually exclusive with local file or HTTP url configurations. When the certificate revocation list is configured to use CDP, all other configured CRL location are ignored.

Note

HTTP redirection is not yet supported.

Set it to Disabled, to disable certificate revocation checks.

The certificate revocation list can only be used when the service is configured with CA certificates stored in a single file in PEM format.

When multiple or chained CA certificates are configured the CRL is only checked for the peer’s certificate and not for the CA certificate or for an intermediate CA.

Note

CDP publishing Delta CRL are not supported.

Note

If the certificate defines multiple HTTP based distribution points in the CDP extension, only the first HTTP URI is used. All non HTTP or the other HTTP URIs are ignored.

The CRL file should be stored in PEM or DER format.

Note

This option is ignored if ssl_certificate_authority is not enabled.

4.15.8. ssl_certificate_revocation_list_refresh

Optional:

Yes

Default value:

0

Values:

• Number of seconds
• 0 to read at startup and after expiration.

From version:

2.8.0

To version:

None

Description:

When set to 0, the CRL file is initially loaded at startup and then loaded again after the Next Update field advertised in the CRL.

If the Next Publish extension is present in the CRL and this option is set to 0 the CRL will be loaded again at the date and time specified in the Next Publish extension.

If the CRL does not advertise the Next Update field you will have to configure a number of seconds after which the CRL should be reloaded, otherwise you will get a configuration error.

It can be configured with the number of seconds after which the local CRL file should be read again.

For example, a value of 86400 means the server will re-read the CRL after one day.

For more details about the CRL reloading see the documentation for CRL reloading rules

Note

This option is ignored if ssl_certificate_authority is not enabled.

4.15.9. ssl_cipher_list

Optional:

Yes

Default value:

ALL:!RC4:!DES:!MD5:!EXP

Values:

• List of SSL/TLS ciphers accepted by the service.

From version:

1.7.4

To version:

None

Description:

The format for this value is the same as the one used for defining the OpenSSL cipher list. More information can be found at the following URL: http://www.openssl.org/docs/apps/ciphers.html#CIPHER_LIST_FORMAT

4.15.10. ssl_allowed_methods

Optional:

Yes

Default value:

tlsv1 tlsv1.1 tlsv1.2

Values:

• list of SSL and TLS methods that will be accepted by this service.

From version:

1.7.4

To version:

None

Description:

Currently, the following methods are officially supported:

• tlsv1 or tlsv1.0, which is TLS 1.0.
• tlsv1.1, which is TLS 1.1.
• tlsv1.2, which is TLS 1.2.

SSLv3 is still supported but highly discouraged, due to the SSLv3 POODLE vulnerability. In the case that you need to interact with an old SSL implementation that only supports SSLv3, it is highly recommended to force the usage of the non-CBC cipher RC4-SHA by configuring ssl_cipher_list: RC4-SHA.

Support for SSLv3 will be removed in future versions.

SSLv2 is no longer supported since it is not secure.

In version 2.8.0, the following new methods were added:

tlsv1.0 (alias for tlsv1), tlsv1.1 and tlsv1.2

4.15.11. idle_connection_timeout

Optional:

Yes

Default value:

300

Values:

• Number of seconds after which idle connections are disconnected.
• 0 - To disable timeouts.
• Disabled - To disable timeouts.

From version:

1.7.19

To version:

None

Description:

The service will close the connection if a client connection is idle for a configurable amount of time.

4.15.12. maximum_concurrent_connections

Optional:

Yes

Default value:

10000

Values:

• Number of maximum concurrent connections accepted by the service.
• 0 - To disable the limit.
• Disabled - To disable the limit.

From version:

1.7.19

To version:

None

Description:

Maximum number of allowed concurrent connections for this service.

This limit is imposed by each service, and it is not a global limit for all services active on the server.

Note

When clients use a web browser, a single session might generate multiple connections (e.g. one for getting the HTML page, one for its images, another one for its CSS files, etc.) This is why maximum_concurrent_connections is not always equal to the maximum number of concurrent users/sessions/clients.