Need a bit more info on how to use proper certificate for internal app

TakadaGuna

Hello,

I am still a beginner in this low code platform thing, so if possible I need pointers how to use proper certificate, so that browsers don't treat my app as security threat.

It was noted in the documentation that we should not keep the default certificate in REI3. We are only developing this app for our internal use only, so we are not going to use the app for public or in the cloud. We connect to the apps using internal IP address. Could someone kind of go over where I should get proper certificate and how to change or to setup REI3 to use that proper certificate?

Thank you very much in advance, and I apologize if this is probably too basic of a question.

Have a good day to you all.

gabriel

Hello 🙂

The topic of certificates has little to do with low code - if you use any browser-based application or website, you run into this issue.

Unfortunately, there is not one explanation on how to do these things. It depends on what your infrastructure is and what software / devices you use and how you manage them.

Our company (Lean Softworks) does consultation about these things if customers need that, but here are some general pointers that might you help you in any case:

Certificates do not work with IPs. You will need DNS and your system needs to be accessed via a hostname or hostnames.
If you do not care about "properly" securing access to your web apps (like R3), because its internal and security is not important, you can import the generated certificate into the trusted root certificate store of your devices. Then the warning will be gone.
You should NEVER consider just running R3 (or any other web app) in HTTP mode - the warning might be annoying, but its much better than no encryption. Some R3 features also only work in an encrypted setting.
If your R3 server can reach the internet and you have at least 1 domain in the public internet, you could setup Let´s Encrypt on your sever. Then you would get automatic certificate renewal on the server and you could redirect your clients via your DNS to your local IP address. This is probably the easiest and cheapest choice if you only want to get a certificate for this single server.
If you have multiple web apps and you only access them internally, a local CA (certificate authority) might be the best choice. In this case, you generate your own root certificate and install it on all of your own devices. Then you can generate new certificates for all your apps/hosts.

The bright side is, that once you have a system for certificates ready to go, you can properly secure all your web applications. It is only some effort the first time to set it up. Afterwards its easy.

Sorry for the long post, but because certificates are the basics for trusted access (and therefore part of the security) of a system, it´s not super easy and there are different considerations.