> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/installation-and-configuration/installation-and-configuration/additional-configurations/https-encryption.md).

# HTTPS Encryption

A secure HTTPS connection is mandatory for the productive use of Enginsight when communicating externally (for example, when accessing the platform from the internet).

To achieve this, you must install [nginx](https://nginx.org/) on the Enginsight Application Server, define ports for internal communication, create an SSL/TLS certificate, and configure the certificate in nginx.

{% hint style="warning" %}
**Please note:** During the **automatic installation** of the Application Server, nginx is installed automatically. When performing a **manual installation** of Enginsight, nginx must be installed separately.
{% endhint %}

***

## Architecture Overview with nginx

The following diagram illustrates the architecture of the Application Server and Database Server, including the protocols and ports used.

![](https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2F6c8Q647USdO4SnU0y82g%2FEnginsight-EN-HTTPS%20Encryption.png?alt=media\&token=5dac162f-44f5-4cd0-a1fe-1172516489aa)

On the Application Server, Docker containers are used to run the **Enginsight user interface** (container name: **ui-m1**) and the **Enginsight API** (container name: **server-m2**). The ui-m1 container uses **port 80**, while the server-m2 container uses **port 8080**.

These container ports are mapped to **internal ports**. Container port **80** is mapped to internal **port 81** (127.0.0.1:81), and container port **8080** is mapped to internal **port 82**. Internal communication continues to use **HTTP**.

**nginx** encrypts these connections using **SSL/TLS certificates** over **HTTPS**.

For external communication, **two domains** are required that both point to the IP address of the Application Server:

* A domain for the user interface, **\<DomainApp>**, running on **port 443**.
* A domain for the API, **\<DomainAPI>**, running on **port 80**.

We recommend that you use an SSL/TLS certificate issued by [Let's Encrypt](https://letsencrypt.org/de/). You can also use your own publicly signed SSL/TLS certificate.

{% hint style="info" %}
Using a self-signed certificate or a Windows PKI is also possible. However, we recommend that you use a publicly trusted certificate.
{% endhint %}

***

## Login to the Application Server

{% hint style="warning" %}
Perform the following steps *on the Enginsight Application Server*.
{% endhint %}

Log in to the Enginsight Application Server if you have not already done so.

You can do this either directly through the console of your Application Server VM or remotely via SSH (Secure Shell) from a different machine.

Continue with the following steps.

***

## Installing nginx

{% hint style="warning" %}
**Please note:** Installing nginx manually is only required if you **install Enginsight manually**. If you are using the **automatic installation script**, nginx is already installed on the Application Server and you can continue directly with [defining ports for internal communication](#ports-fur-die-interne-kommunikation-definieren).&#x20;
{% endhint %}

Install nginx using the following command:

```
sudo apt install nginx
```

Press **Enter** to confirm your input.

***

## Defining Ports for Internal Communication

{% hint style="warning" %}
**Please note:** Defining ports for internal communication is required for **both manual and automatic Enginsight installations**.
{% endhint %}

To ensure the smooth internal communication between services, the Docker container ports used by the Enginsight user interface (container name: ui-m1, port: 80) and the Enginsight API (container name: server-m2, port: 8080) must be mapped to internal ports.

This is necessary because nginx would otherwise also bind to port 80, which would result in a startup error.

Follow these steps:

{% stepper %}
{% step %}
Navigate to the Enginsight installation directory using the following command:

```
cd /opt/enginsight/enterprise
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
Open the Docker configuration file `docker-compose.yml` using the following command:

```
sudo nano docker-compose.yml
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
Navigate to the `ui-m1` section and adjust the internal port for the Enginsight user interface as follows:

<pre><code>ui-m1:
    image: registry.enginsight.com/enginsight/ui-m1:x.x.x
    ports:
<strong>    - "127.0.0.1:81:80"
</strong>    restart: always
    volumes:
    - "./conf/ui-m1/environment.js.production:/opt/enginsight/ui-m1/config/environment.js"
</code></pre>

{% endstep %}

{% step %}
Navigate to the `server-m2` section and adjust the internal port for the Enginsight API as follows:

<pre><code>server-m2:
    image: registry.enginsight.com/enginsight/server-m2:x.x.x
    networks:
    - redis
    ports:
<strong>    - "127.0.0.1:82:8080"
</strong></code></pre>

{% endstep %}

{% step %}
Save the changes to the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
{% endstep %}

{% step %}
Stop the Docker instance using the following command so that port 80 becomes available and the configuration changes can be applied:

```
sudo docker-compose down
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
Enable nginx using the following command to ensure that it starts automatically when the system boots:

```
sudo systemctl enable nginx
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
You must now run the Application Server setup script again to apply your changes.

Navigate to the Enginsight installation directory:

```
cd /opt/enginsight/enterprise
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
Run the Application Server setup script anew using the following command and confirm all prompts by pressing **Enter**:

```
sudo ./setup.sh
```

{% endstep %}
{% endstepper %}

***

## Optional: Creating a SSL/TLS Certificate by Let's Encrypt

{% hint style="info" %}
**Please note:** If you want to use your **own publicly signed SSL/TLS certificate**, you can **skip this section** and continue directly with the section [Using your own certificate](#verwendung-eines-eigenen-zertifikats). Otherwise, creating an SSL/TLS certificate by Let's Encrypt is required for **both manual and automatic Enginsight installations**.
{% endhint %}

To secure external communication using HTTPS, you need an SSL/TLS certificate. We recommend that you use a certificate issued by Let's Encrypt.

{% hint style="warning" %}
**Please note:** SSL/TLS certificates by Let's Encrypt are only valid for **three months** and must be renewed accordingly.
{% endhint %}

{% hint style="success" icon="lightbulb" %}
For more information on how to renew a Let's Encrypt certificate, see our Knowledge Base: [How do I update a SSL/TLS certificate by Let's Encrypt in Enginsight?](https://docs.enginsight.com/docs/knowledge-base/english/configuration/how-do-i-update-a-ssl-tls-certificate-by-lets-encrypt-in-enginsight)
{% endhint %}

Follow these steps to create an SSL/TLS certificate by Let's Encrypt:

{% stepper %}
{% step %}
Open the **nginx configuration file** using the following command:

* Command for an **automatic installation**:

```
sudo nano /etc/nginx/sites-available/ngs.conf
```

Press **Enter** to confirm your input.

* Command for a **manual installation**:

```
sudo nano /etc/nginx/sites-available/default
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
Copy the following template into your console or terminal and replace the placeholders `<DomainAPI>` and `<DomainApp>` accordingly:

<pre><code>server {
        listen 80;
        listen [::]:80;
 
        location ~ /.well-known {
                allow all;
        }
 
        location / {
<strong>                return 302 https://&#x3C;DomainAPI>;
</strong>        }
 
<strong>        root /var/www/&#x3C;DomainAPI>;
</strong> 
<strong>        server_name &#x3C;DomainAPI>;
</strong>}
 
server {
        listen 80;
        listen [::]:80;
 
        location ~ /.well-known {
                allow all;
        }
 
        location / {
<strong>                return 302 https://&#x3C;DomainApp>;
</strong>        }
 
<strong>        root /var/www/&#x3C;DomainApp>;
</strong> 
<strong>        server_name &#x3C;DomainApp>;
</strong>}
</code></pre>

{% endstep %}

{% step %}
Save the changes to the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
{% endstep %}

{% step %}
Check the nginx configuration using the following command and press **Enter** to confirm your input:

```
sudo nginx -t
```

If the configuration changes are valid, you will receive the following output:

```
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
```

{% endstep %}

{% step %}
Restart nginx using the following command:

```
sudo systemctl restart nginx
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
Install [Certbot](https://certbot.eff.org/), a tool that automates the creation and installation of SSL/TLS certificates by Let's Encrypt, using the following command:

```
sudo apt-get install certbot
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
Create a directory for each of the subdomains **ngs-api** and **ngs-app** where the certificate files will be stored:

```
sudo mkdir -p /var/www/<DomainAPI>
```

```
sudo mkdir -p /var/www/<DomainApp>
```

{% hint style="info" %}
Remember to replace `<DomainAPI>` and `<DomainApp>` accordingly.
{% endhint %}

Confirm each command by pressing **Enter**.
{% endstep %}

{% step %}
Create and store the certificate files using the following commands:

```
sudo certbot certonly --rsa-key-size 4096 --webroot -w /var/www/<DomainAPI> -d <DomainAPI>
```

```
sudo certbot certonly --rsa-key-size 4096 --webroot -w /var/www/<DomainApp> -d <DomainApp>
```

{% hint style="info" %}
Remember to replace `<DomainAPI>` and `<DomainApp>` accordingly.
{% endhint %}

Confirm each command by pressing **Enter**.
{% endstep %}

{% step %}
Generate the Diffie-Hellman (DH) parameters used to securely exchange secret keys over an untrusted communication channel:

```
sudo openssl dhparam -out dhparam.pem 4096
```

Press **Enter** to confirm your input.

{% hint style="warning" %}
**Please note:** Depending on the performance and load of your system, generating the DH parameters may take some time. Wait until the process has completed.
{% endhint %}
{% endstep %}
{% endstepper %}

***

## Configuring the SSL/TLS Certificate in nginx

The SSL/TLS certificate must now be integrated into the nginx configuration. The required steps differ depending on whether you are using a Let's Encrypt certificate or your own publicly signed certificate.

### Using a Let's Encrypt Certificate

{% hint style="warning" %}
**Please note:** Let's Encrypt certificates are valid for **three months**. Make sure to renew your certificate before it expires.
{% endhint %}

{% hint style="success" icon="lightbulb" %}
For more information on how to renew a Let's Encrypt certificate, see our Knowledge Base: [How do I update a SSL/TLS certificate by Let's Encrypt in Enginsight?](https://docs.enginsight.com/docs/knowledge-base/english/configuration/how-do-i-update-a-ssl-tls-certificate-by-lets-encrypt-in-enginsight)
{% endhint %}

Follow these steps if you are using a Let's Encrypt certificate:

{% stepper %}
{% step %}
Open the **nginx configuration file** using the following command:

* Command for an **automatic installation**:

```
sudo nano /etc/nginx/sites-available/ngs.conf
```

Press **Enter** to confirm your input.

* Command for a **manual installation**:

```
sudo nano /etc/nginx/sites-available/default
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
Compare the following template with your configuration file and adjust the highlighted lines as follows:

* Replace the placeholders `<DomainAPI>` and `<DomainApp>` accordingly.
* Update the lines beginning with `proxy_pass` to use the internal ports specified below.

{% hint style="warning" %}
**Please note:** The Diffie-Hellman parameter (`dhparam`) is not created by default and must be generated first, otherwise nginx will return an error. Instructions for generating the `dhparam` parameter can be found in the previous section [Optional: Creating an SSL/TLS Certificate by Let's Encrypt](#optional-ssl-tls-zertifikat-von-lets-encrypt-erstellen), Step 9.

In our example, we use a key length of **2048 bits**. While this is secure, we recommend using **3072 bits** or **4096 bits**. If you choose a larger key length, please note that generating the key will take significantly longer.
{% endhint %}

<pre><code>map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}
server {
        listen 80;
        listen [::]:80;
 
        location ~ /.well-known {
                allow all;
        }
 
        location / {
<strong>                return 302 https://&#x3C;DomainAPI>;
</strong>        }
 
<strong>        root /var/www/&#x3C;DomainAPI>;
</strong> 
<strong>        server_name &#x3C;DomainAPI>;
</strong>}
 
server {
        listen 80;
        listen [::]:80;
 
        location ~ /.well-known {
                allow all;
        }
 
        location / {
<strong>                return 302 https://&#x3C;DomainApp>;
</strong>        }
 
<strong>        root /var/www/&#x3C;DomainApp>;
</strong> 
<strong>        server_name &#x3C;DomainApp>;
</strong>}
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

<strong>    server_name &#x3C;DomainApp>;
</strong>
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "ECDHE+AESGCM+AES256";
    ssl_ecdh_curve secp384r1;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    # Erstellung von dhparam.pem:
    #$ sudo mkdir /etc/nginx/ssl -p
    #$ sudo openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
  
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
    
<strong>    ssl_certificate /etc/letsencrypt/live/&#x3C;DomainApp>/fullchain.pem;
</strong><strong>    ssl_certificate_key /etc/letsencrypt/live/&#x3C;DomainApp>/privkey.pem;
</strong>
    client_max_body_size 200m;

    location / {
<strong>        proxy_pass http://127.0.0.1:81;
</strong>        proxy_set_header Host              $host;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-Proto "https";
        proxy_set_header X-Forwarded-Ssl   "on";
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        $connection_upgrade;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

<strong>    server_name &#x3C;DomainAPI>;
</strong>
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "ECDHE+AESGCM+AES256";
    ssl_ecdh_curve secp384r1;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    # Generating dhparam.pem:
    #$ sudo mkdir /etc/nginx/ssl -p
    #$ sudo openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
    
<strong>    ssl_certificate /etc/letsencrypt/live/&#x3C;DomainAPI>/fullchain.pem;
</strong><strong>    ssl_certificate_key /etc/letsencrypt/live/&#x3C;DomainAPI>/privkey.pem;
</strong>
    client_max_body_size 200m;

    location / {
<strong>        proxy_pass http://127.0.0.1:82;
</strong>        proxy_set_header Host              $host;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-Proto "https";
        proxy_set_header X-Forwarded-Ssl   "on";
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        $connection_upgrade;
    }
}
</code></pre>

{% endstep %}

{% step %}
Save the changes to the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
{% endstep %}

{% step %}
Check the nginx configuration using the following command and press **Enter** to confirm your input:

```
sudo nginx -t
```

If the configuration changes are valid, you will receive the following output:

```
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
```

{% endstep %}

{% step %}
Restart nginx using the following command:

```
sudo systemctl restart nginx
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
You must now run the Application Server setup script again to switch both the **APP URL** and the **API URL** to HTTPS.

Navigate to the Enginsight installation directory:

```
cd /opt/enginsight/enterprise
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
Run the setup script anew using the following command:

```
sudo ./setup.sh
```

When prompted to enter the URIs and URLs, enter the URLs for the Enginsight User Interface and API as follows:

* **Enter App URL**: <mark style="color:$danger;">`https`</mark>`://<DomainApp>`
* **Enter API URL**: <mark style="color:$danger;">`https`</mark>`://<DomainAPI>`

Press **Enter** to confirm your input.

{% hint style="danger" %}
**Please note:** If you do not make this change, or if you accidentally enter `http://`, your Enginsight instance will continue to be accessible only via HTTP, even though nginx is already providing a secure HTTPS connection.
{% endhint %}
{% endstep %}

{% step %}
Continue with the [setup of the Application Server](/docs/manual/english/installation-and-configuration/installation-and-configuration/enginsight-platform/automated-installation/application-server.md#applikationsserver-setup-abschliessen).
{% endstep %}
{% endstepper %}

### Using Your Own Publicly Signed Certificate

{% hint style="warning" %}
**Please note:** The certificate must be provided as a **complete certificate chain**, together with a **separate private key**, and in **PEM format**.
{% endhint %}

Follow these steps if you are using your own publicly signed certificate:

{% stepper %}
{% step %}
On the system where your certificate is stored, navigate to the directory that contains all certificate files using the following command:

```
cd /<CustomDirectoryPath>/<CertificateFilesDirectory>
```

{% hint style="info" %}
Remember to replace `<CustomDirectoryPath>` and `<CertificateFilesDirectory>` accordingly.
{% endhint %}

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
Upload the certificate files to the Application Server in a target directory of your choice using the following command:

```
<CertificateFilesDirectory> % scp * <ApplicationServerUsername>@<ApplicationServerIPAddress>:<TargetDirectoryApplicationServer>
```

{% hint style="info" %}
Remember to replace the following placeholders in `<>` accordingly:

* `<CertificateFilesDirectory>`
* `<ApplicationServerUsername>`
* `<ApplicationServerIPAddress>`
* `<TargetDirectoryApplicationServer>`
  {% endhint %}

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
The uploaded certificate files are currently only readable by the user who uploaded them and not by the web server. The file permissions must therefore be adjusted.

Run the following command:

```
sudo chown root: *.pem
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
You can now adjust the nginx configuration. Open the **nginx configuration file** using the following command:

* Command for an **automatic installation**:

```
sudo nano /etc/nginx/sites-available/ngs.conf
```

Press **Enter** to confirm your input.

* Command for a **manual installation**:

```
sudo nano /etc/nginx/sites-available/default
```

Press **Enter** to confirm your input.

Compare the following template with your configuration file and adjust the highlighted lines as follows:

* Replace the placeholders `<DomainApp>` and `<DomainAPI>` accordingly.
* For `<CustomDirectoryURL>`, specify the path that contains your certificate files.
* Update the lines beginning with `proxy_pass` to use the internal ports shown below.
  {% endstep %}

{% step %}

<pre><code>map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

<strong>    server_name &#x3C;DomainApp>;
</strong>
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "ECDHE+AESGCM+AES256";
    ssl_ecdh_curve secp384r1;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    # Erstellung von dhparam.pem:
    #$ sudo mkdir /etc/nginx/ssl -p
    #$ sudo openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
    
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
    
<strong>    ssl_certificate /&#x3C;CustomDirectoryURL>/fullchain.pem;
</strong><strong>    ssl_certificate_key /&#x3C;CustomDirectoryURL>/privkey.pem;
</strong>
    client_max_body_size 200m;

    location / {
<strong>        proxy_pass http://127.0.0.1:81;
</strong>        proxy_set_header Host              $host;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-Proto "https";
        proxy_set_header X-Forwarded-Ssl   "on";
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        $connection_upgrade;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

<strong>    server_name &#x3C;DomainAPI>;
</strong>
    ssl_protocols TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "ECDHE+AESGCM+AES256";
    ssl_ecdh_curve secp384r1;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    # Erstellung von dhparam.pem:
    #$ sudo mkdir /etc/nginx/ssl -p
    #$ sudo openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
    
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
    
<strong>    ssl_certificate /&#x3C;CustomDirectoryURL>/fullchain.pem;
</strong><strong>    ssl_certificate_key /&#x3C;CustomDirectoryURL>/privkey.pem;
</strong>
    client_max_body_size 200m;

    location / {
<strong>        proxy_pass http://127.0.0.1:82;
</strong>        proxy_set_header Host              $host;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-Proto "https";
        proxy_set_header X-Forwarded-Ssl   "on";
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        $connection_upgrade;
    }
}
</code></pre>

{% endstep %}

{% step %}
Save the changes to the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
{% endstep %}

{% step %}
Check the nginx configuration using the following command and press **Enter** to confirm your input:

```
sudo nginx -t
```

If the configuration changes are valid, you will receive the following output:

```
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
```

{% endstep %}

{% step %}
Restart nginx using the following command:

```
sudo systemctl restart nginx
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
You must now run the Application Server setup script again to switch both the **APP URL** and the **API URL** to HTTPS.

Navigate to the Enginsight installation directory using the following command:

```
cd /opt/enginsight/enterprise
```

Press **Enter** to confirm your input.
{% endstep %}

{% step %}
Run the setup script anew using the following command:

```
sudo ./setup.sh
```

When prompted to enter the URIs and URLs, enter the URLs for the Enginsight user interface and API as follows:

* **Enter App URL**: <mark style="color:$danger;">`https`</mark>`://<DomainApp>`
* **Enter API URL**: <mark style="color:$danger;">`https`</mark>`://<DomainAPI>`

Press **Enter** to confirm your input.

{% hint style="danger" %}
**Please note:** If you do not make this change, or if you accidentally enter `http://`, your Enginsight instance will continue to be accessible only via HTTP, even though nginx is already providing a secure HTTPS connection!
{% endhint %}
{% endstep %}

{% step %}
Continue with the [setup of the Application Server](/docs/manual/english/installation-and-configuration/installation-and-configuration/enginsight-platform/automated-installation/application-server.md#applikationsserver-setup-abschliessen).
{% endstep %}
{% endstepper %}

### Using a Self-Signed Certificate or a Windows PKI

{% hint style="success" icon="lightbulb" %}
For more information on how to configure a self-signed certificate in Enginsight, see our Knowledge Base: [How do I store and configure a self-signed SSL/TLS certificate in Enginsight?](https://docs.enginsight.com/docs/knowledge-base/english/configuration/how-do-i-store-and-configure-a-self-signed-ssl-tls-certificate-in-enginsight)
{% endhint %}

***

## Further Resources

**Knowledge Base**

* [How do I update a SSL/TLS certificate by Let's Encrypt in Enginsight?](https://docs.enginsight.com/docs/knowledge-base/english/configuration/how-do-i-update-a-ssl-tls-certificate-by-lets-encrypt-in-enginsight)
* [How do I store and configure a self-signed SSL/TLS certificate in Enginsight?](https://docs.enginsight.com/docs/knowledge-base/english/configuration/how-do-i-store-and-configure-a-self-signed-ssl-tls-certificate-in-enginsight)
* [How do I replace a self-signed SSL/TLS certificate in Enginsight?](https://docs.enginsight.com/docs/knowledge-base/english/configuration/how-do-i-replace-a-self-signed-ssl-tls-certificate-in-enginsight)
* [What adjustments do I need to make if my Enginsight domain changes?](https://docs.enginsight.com/docs/knowledge-base/english/configuration/what-adjustments-do-i-need-to-make-if-my-enginsight-domain-changes)

***