Setting up SSL for OpenLM SLM and Identity Service

This is a quick guide to setting up the SSL connection for OpenLM SLM and Identity Service v21 or later.

Important:

• The certificates used for the SLM must also be installed and present in the Trusted Certificate Store of the machine with the component connecting to the OpenLM SLM.
• Once the server's SSL is activated, all components that connect to it must update their hostname/IP to use the HTTPS protocol. As with the SLM configuration, ensure the exact FQDN is used when specifying the host.
• The screenshots use a self-signed certificate for demonstration only. In production, use a certificate signed by a trusted certificate authority (CA): self-signed certificates aren't supported. See System requirements.

Setting up SSL for Identity Service

1. Go to C:\Program Files\OpenLM\OpenLM Identity Service\SecurityService\cert and place here the certificate with a digital signature from a certificate authority (CA).
   Attention. Do not delete any existing certificates.
2. Open the appsettings.json file at C:\Program Files\OpenLM\OpenLM Identity Service\SecurityService with a convenient text editor and administrator privileges.
3. Locate the Settings node and change the "IssuerUri" parameter from HTTP to HTTPS:

},
  "Settings": {
    "UseDb": true,
    "IssuerUri": "https://FQDN:5000",
    "DbType": "MariaDB"
  },

4. Edit the Kestrel node. Provide the data for the certificate: path to the Certificate and password then change the URL parameter from HTTP to HTTPS. By default the Identity Service listens on port 5000 (HTTP) and port 5001; after this change, the endpoint on port 5000 uses HTTPS and the certificate you configured:

  },
  "Kestrel": {
    "Endpoints": {
      "Http": {
        "Url": "https://FQDN:5000",
        "Certificate": {
          "Path": "./cert/cert.pfx",
          "Password": "Cert Password"
        }
      },
      "Https": {
        "Url": "http://*:5001"
      }
    }
  },

• Path - The path to the certificate file. A relative path with forward slashes works, as in the sample. If you use an absolute Windows path, escape each backslash (for example, C:\\Certs\\cert.pfx).
• Keep the endpoint names Http and Https as they are. They're labels only: after this change, the endpoint named Http serves HTTPS on port 5000.
• Password - the password for the private key of the certificate.
• Certificate Name - The certificate name should be 'cert.pfx'

Note: make sure the curly braces are properly closed at all times.

5. Save the changes.

6. Restart the Identity Service:

7. To verify whether the SSL connection is successful, open up the Identity Service UI, type in the address bar the new address (HTTPS), and refresh the page. Select the "Lock" icon as portrayed below:

Setting up SSL for OpenLM SLM

1. Go to C:\Program Files\OpenLM\OpenLM Server\bin and create a folder called "Cert", then paste the certificate with a digital signature from a certificate authority (CA) to this folder.

2. Open up the appsettings.json located at C:\Program Files\OpenLM\OpenLM Server\bin in a text editor with administrator privileges.

3. Locate and edit the Kestrel node configurations and update the URL for the Kestrel endpoint, that is, the full path to EasyAdmin: https://FQDN:port

},
  "Kestrel": {
    "Endpoints": {
      "Http": {
        "Url": "https://FQDN:5015"
      },

4. Locate and edit the Certificates node. Provide the following details:

• Path - The path to the certificate file. In a Windows path, escape each backslash (for example, C:\\Certs\\cert.pfx).
• Password - the password for the private key of the certificate.

Note: make sure the curly braces are properly closed at all times.

},
    "Certificates": {
      "Default": {
        "Path": "./cert/cert.pfx",
        "Password": "12345"
      }
    },

5. Locate the "Auth" node and edit the "Authority" line with the updated Identity Service URL (HTTPS)

},
  "Auth": {
    "EnableSecurity": true,
    "Authority": "https://hostname:5000",
    "Audience": "openlm.server.api",
    "AuthProvider": "",
    "ClientId": "openlm.server.client",
    "ClientSecret": "<generated by Identity Service>",
    "ClientScope": "openlm.cloud.scope openlm.ugs.read.scope IdentityServerApi openlm.dss.scope openlm.etlmanager.scope",
    "TokenEndpoint": "/connect/token"
  }
}

6. Save the changes (Ctrl+S).

7. Now it is time to change the OpenLM SLM URL we have declared in the Identity Service Settings. Log in to the Identity Service→Settings→Security Configuration tab and declare the updated OpenLM SLM address (HTTPS) and select Save:

8. Restart the Server Service.

9. To verify the connection, type in the address bar the updated EasyAdmin address: https://FQDN:port

Renew or replace a certificate

When a certificate expires, replace it on each component that serves HTTPS: Identity Service, OpenLM SLM, and DSS. The URLs stay the same. You change only the certificate file and, if it changed, its password.

Before you begin:

• Get the new certificate as a .pfx file that includes the private key, and note its password. These components load the certificate from the file, not from the Windows certificate store.
• Install the new certificate, or the certificate authority that issued it, in the trusted certificate store of every machine that connects to OpenLM over HTTPS, including the DSA, Broker, and workstation machines. For Brokers on Linux, also import it into the Java keystore. See Trust the certificate.

Replace the certificate in this order:

1. Identity Service. Copy the new .pfx file to C:\Program Files\OpenLM\OpenLM Identity Service\SecurityService\cert. If its file name or password differs from the old one, update Path and Password under Kestrel → Endpoints → Http → Certificate in appsettings.json. Don't change SigningCredential: it's the certificate Identity Service signs tokens with, not the HTTPS certificate. Restart the Identity Service.
2. OpenLM SLM. Copy the new .pfx file to C:\Program Files\OpenLM\OpenLM Server\bin\Cert. If its file name or password differs, update Path and Password under Kestrel → Certificates → Default in appsettings.json. Restart the OpenLM Server service.
3. DSS. In the DSS UI, keep the SSL toggle on and enter the new certificate path and password, as in DSS & DSA SSL configuration. The settings are stored as CertFileName and CertPassword in kestrel.config in the DSS installation folder. Restart the DSS service.

The DSA, Brokers, and Workstation Agents don't need their own certificate. They only need to trust the new one.

To check the result, open EasyAdmin, the Identity Service UI, and the DSS UI over HTTPS, select the lock icon in the browser, and check the certificate's expiry date.

Warning

Keep Url under Kestrel → Endpoints → Http in the OpenLM SLM appsettings.json set to the full address, for example https://FQDN:5015. If it's empty or contains *, OpenLM SLM rewrites the Kestrel section when it starts and drops any settings it doesn't recognize.

Turn on HTTPS request redirection (optional)

Note

Supported version: OpenLM SLM 24.1+

Starting with clean installations or upgrades of OpenLM Software License Management (SLM) v24.1+, an additional parameter appears in appsettings.json (default path: C:\Program Files\OpenLM\OpenLM Server\bin). It controls automatic redirection of incoming HTTP requests to HTTPS:

"HTTPSRequestsRedirectionEnabled": false

By default, the system keeps redirection turned off (false). After you turn it on, any request that reaches the HTTP endpoint redirects (HTTP 301/302) to the HTTPS endpoint.

Turn on HTTPS redirection

1. Open appsettings.json (Administrator privileges required).
2. Change the parameter value to:

   "HTTPSRequestsRedirectionEnabled": true,

3. Add (or verify) an HTTPS Kestrel endpoint under the Kestrel > Endpoints node. Example:

   "Kestrel": {
     "Endpoints": {
       "Http": {
         "Url": "http://*:5015"
       },
       "Https": {
         "Url": "https://FQDN:5443",
         "Certificate": {
           "Path": "./cert/cert.pfx",
           "Password": "<certificate-password>"
         }
       }
     }
   }

4. Pick an HTTPS port different from the HTTP port and confirm no other service uses it (for example 443, 8443, 5443). Use any free port that matches firewall rules and is reachable by clients.
5. Place the certificate file (cert.pfx) under C:\Program Files\OpenLM\OpenLM Server\bin\Cert (or the path you specify) and confirm its password.
6. Save the file and restart the OpenLM Server service.

Turn off HTTPS redirection

If you need to turn off automatic redirection:

1. Set the parameter back to:

   "HTTPSRequestsRedirectionEnabled": false,

2. (Optional) Remove the Https endpoint block you previously added. You must keep the Http endpoint. Example of a minimal valid Kestrel section:

   "Kestrel": {
     "Endpoints": {
       "Http": {
         "Url": "http://*:5015"
       }
     }
   }

3. Restart the OpenLM Server service.

Important notes

• Do not delete the Http endpoint. If it is missing the server does not start.
• Keep an Http endpoint even when HTTPS and redirection are on.
• After you turn on redirection, clients that use plain http:// redirect automatically. Still, update component configurations to use the https:// URL directly.
• Ensure the Identity Service URL (Authority) stays set to HTTPS as shown earlier in this guide.
• Firewall / reverse proxy: open the chosen HTTPS port and adjust any load balancer rules to forward HTTPS traffic correctly.

Verification

1. Browse to the HTTP URL (for example, http://FQDN:5015). You are automatically redirected to the HTTPS URL.
2. Confirm the browser shows a secure lock icon (certificate trusted). If not, check the certificate chain in the Windows Certificate Store and verify that intermediate and root certificates are present.
3. Review OpenLM SLM logs for any Kestrel binding errors related to the HTTPS port or certificate.

Troubleshooting

Symptom	Possible cause	Action
Service fails to start	Missing Http endpoint	Re-add Http endpoint under Kestrel > Endpoints.
Browser not redirected	HTTPSRequestsRedirectionEnabled still false	Confirm value saved; restart service.
HTTPS port in use error	Port conflict with another service	Select a different free port; update config; restart.
Browser still shows the old certificate after you replaced it	The service didn't restart, or Path points to the old file	Check Path and Password, then restart the service.
Certificate error / untrusted	Using self-signed cert without CA trust	Install certificate chain on client machines or obtain CA-signed certificate.
404 after redirect	Incorrect Https URL or reverse proxy misconfiguration	Verify Https endpoint URL and proxy forwarding rules.