Philter serves HTTPS on port 8080. When it starts without a certificate, as it does on the AWS, Azure, and Google Cloud marketplace images, it generates a self-signed one, so clients have to skip verification (curl -k). Replace it with a certificate issued to your organization by a trusted authority before production use. This guide is for Philter 4.0 on a marketplace virtual machine; the same two settings apply to any Docker deployment.
1. Request the certificate
Create a private key and a certificate signing request (CSR) for Philter’s host name. This walkthrough uses philter.yourdomain.com:
openssl req -new -newkey rsa:2048 -nodes -keyout philter_yourdomain_com.key -out philter_yourdomain_com.csr
Submit the CSR to your certificate authority. If it asks for a web server type, choose Apache or Nginx. You will receive a few files; the names vary, and you may receive others as well:
| File Name | Description | Creator |
|---|---|---|
philter_yourdomain_com.csr | Certificate signing request | Created by you |
philter_yourdomain_com.key | Certificate private key | Created by you |
philter_yourdomain_com.ca-bundle | Intermediate certificates provided by the issuing authority | Received from SSL authority |
philter_yourdomain_com.crt | The SSL certificate for philter.yourdomain.com | Received from SSL authority |
2. Build a PKCS12 keystore
Combine the certificate, its intermediate certificates, and the private key into one PKCS12 file. Philter looks for the key under the alias philter:
openssl pkcs12 -export -in philter_yourdomain_com.crt -certfile philter_yourdomain_com.ca-bundle \
-inkey philter_yourdomain_com.key -name philter -out philter-cert.p12
openssl asks for an export password. Philter needs it to open the keystore.
3. Install it on the virtual machine
Copy philter-cert.p12 to the virtual machine, then put it where Philter’s container can read it. The container runs as user 10001, and only that user should be able to read the key:
sudo cp philter-cert.p12 /opt/philter/ssl/
sudo chown 10001:10001 /opt/philter/ssl/philter-cert.p12
sudo chmod 600 /opt/philter/ssl/philter-cert.p12
Tell Philter to use it by adding two lines to /opt/philter/.env, the file that also holds Philter’s keys:
SSL_KEYSTORE=/opt/philter/ssl/philter-cert.p12
SSL_KEYSTORE_PASSWORD=<the export password>
Restart Philter so it picks up the settings:
sudo systemctl restart philter
4. Verify
Request Philter’s health endpoint without -k. The -v option shows the certificate Philter presented:
curl -v https://philter.yourdomain.com:8080/api/health
The certificate details name your host and your certificate authority, and the verification succeeds:
* subject: CN=philter.yourdomain.com
* subjectAltName: host "philter.yourdomain.com" matched cert's "philter.yourdomain.com"
* issuer: CN=<your certificate authority>
* SSL certificate verify ok.
From now on, clients can drop -k.
Other deployments
Running Philter’s Docker image yourself, mount the keystore into the container and set the same SSL_KEYSTORE and SSL_KEYSTORE_PASSWORD variables. SSL_KEY_ALIAS and SSL_KEYSTORE_TYPE cover a different alias or a JKS keystore. To terminate TLS at a load balancer or reverse proxy instead, set SSL_ENABLED=false so Philter serves plain HTTP on the same port; see using an Apache reverse proxy with Philter. Every setting is described in Philter’s TLS documentation.