HTTPS Does Not Work For Management Server

[fnavidan]

I'm running CloudStack 4.22.0.0. I'm trying to enable https for management server UI. I have done following steps:

• Obtained a valid certificate for my desired UI hostname
• Converted certificate and private key to PKCS12 format
• Imported certificate and private key into keystore located at /etc/cloudstack/management/cloud.jks
• Enabled https and set keystore password in server.properties file.
• Opened port 8443 in firewall
• Changed ownership of /etc/cloudstack/management/cloud.jks to user 'cloud'

However, after restarting management server, UI is only accessible via http.

I've already looked into management server log and no https or keystore related error is found.

Any idea?

[dahampere]

I run 3 management nodes, but I use haproxy to offload SSL, while load-balancing https traffic to keep things simple on the cloudstack end. With the upcoming SSL certificate renewal changes, this might be the safest and cleanest option going forward.

[Flpvoigt]

CloudStack's embedded Jetty can terminate HTTPS directly, so HAProxy is optional. The first thing I would verify is that the settings are in the active file, /etc/cloudstack/management/server.properties, without a second conflicting entry:

https.enable=true
https.port=8443
https.keystore=/etc/cloudstack/management/cloud.jks
https.keystore.password=<the-keystore-password>

A few checks are important:

• Confirm the keystore contains a private-key entry, not only a trusted certificate: keytool -list -v -keystore /etc/cloudstack/management/cloud.jks.
• Make sure the keystore and every parent directory are readable/traversable by the account running cloudstack-management (changing only the file ownership may not be enough).
• Confirm the certificate SAN contains the hostname used in the browser, and that the keystore contains the full certificate chain.
• Restart the service and check the first startup lines in /var/log/cloudstack/management/management-server.log. They should show https.enable=true and https.port=8443. If the log still says https.enable=false, CloudStack is not reading the settings you edited.
• Test the endpoint directly with curl -vk https://:8443/client and verify that TCP/8443 is allowed between your browser and the management server.

The official configuration uses these same server.properties keys and requires the keystore to exist and be readable by the management server: https://docs.cloudstack.apache.org/en/4.20.1.0/installguide/optional_installation.html

If it still starts only on HTTP, please paste the startup line containing http.enable/https.enable and the output of keytool -list with passwords and private details redacted.