Cockpit usually requires that web browsers communicate with it using HTTPS, for security reasons.
Cockpit listens for both HTTP and HTTPS connections on the same port, by default 9090. If an HTTP connection is made, Cockpit will redirect that connection to HTTPS. There are some exceptions:
If an HTTP connection comes from
Cockpit will allow communication without redirecting to HTTPS.
Certain URLs, like
/ping are not required to use
Cockpit will load a certificate from the
directory. It will use the first file with a
.cert extension in
alphabetical order. The
.cert file should contain at least two
OpenSSL style PEM blocks. First one or more
blocks for the server certificate and the intermediate certificate authorities
and a last one containing a
BEGIN PRIVATE KEY or similar.
The key may not be encrypted. For example:
-----BEGIN CERTIFICATE----- MIIDUzCCAjugAwIBAgIJAPXW+CuNYS6QMA0GCSqGSIb3DQEBCwUAMD8xKTAnBgNV BAoMIGI0OGE2NGNkNmMwNTQ1YThhZTgxOTEzZDE5YmJjMmRjMRIwEAYDVQQDDAls ... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIDUzCCAjugAwIBAgIJAPXW+CuNYS6QMA0GCSqGSIb3DQEBCwUAMD8xKTAnBgNV BAoMIGI0OGE2NGNkNmMwNTQ1YThhZTgxOTEzZDE5YmJjMmRjMRIwEAYDVQQDDAls ... -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCyOJ5garOYw0sm 8TBCDSqQ/H1awGMzDYdB11xuHHsxYS2VepPMzMzryHR137I4dGFLhvdTvJUH8lUS ... -----END PRIVATE KEY-----
If no certificate is found, a self-signed certificate is created. using the
openssl command and stored in the
To check which certificate
cockpit-ws will use run
the following command.
$ sudo remotectl certificate
By default Cockpit will only use modern secure ciphers and versions of TLS. In particular SSL v3.0 is disabled by default, as well as the RC4 cipher.
If you wish to enable these legacy protocols and algorithms you can do so
by passing an environment variable to cockpit-ws. Place the following in the
/etc/systemd/system/cockpit.service.d/ssl.conf file. Create the
file and directories in that path which don't already exist.
The environment variable value is a GnuTLS priority string.