ZEC Configuring HTTPS

zec supports https encryption based on openssl zec expects certificate files in x 509 textual format (sometimes called ‘pem’) with a full chain of certificates, each one starts with “ begin certificate ", and the associated private key file, that starts with “ begin private key " the certificate can be provided by an ssl/tls certificate provider (certification authority) where the domain is registered, such as verisign, digicert, etc alternatively the certificate can be self signed a self signed certificate is a certificate that is signed with its own private key self signed certificates can be used to encrypt data just as well as ca signed certificates, but your users will be displayed a warning that says that the certificate is not trusted by their computer or browser therefore, self signed certificates should only be used if you do not need to prove your service’s identity to its users (e g non production or non public servers) obtaining a ca signed certificate reach out to the hosting provider for instructions on how to obtain a ca signed https certificate as part of this process, you will be required to generate a certificate signing request (csr) a csr consists mainly of the public key of a key pair, and some additional information both of these components are inserted into the certificate when it is signed to learn more about generating a csr, go to https //www digitalocean com/community/tutorials/openssl essentials working with ssl certificates private keys and csrs https //www digitalocean com/community/tutorials/openssl essentials working with ssl certificates private keys and csrs creating a self signed certificate instead of obtaining a ca signed certificate, you can create a self signed certificate you can generate self signed x 509 certs with openssl by using the following command openssl req x509 newkey rsa 2048 keyout selfsigned key pem out selfsigned cert pem to learn more about generating a self signed certificate, go to https //www digitalocean com/community/tutorials/openssl essentials working with ssl certificates private keys and csrs https //www digitalocean com/community/tutorials/openssl essentials working with ssl certificates private keys and csrs uploading the certificate and private key after obtaining a ca signed certificate or creating a self signed one, you will need to upload the certificate and private key to zec to upload the certificate and private key go to settings > general click + to expand the https and dtls streaming certificate section in the certificate uploaded field, click upload and select the certificate file in the private key uploaded field, click upload and select the private key in the private key passphrase field, type the passphrase or leave empty (default passphrase is empty, ignore the ‘ ’) click apply if the process was successful, the ssl setup status field will turn to " ok "