Skip to main content

API/MistServer interface over SSL

Setting up SSL for the API/interface is done as boot parameter​

With 3.12 the MistServer interface gained the ability to bind a certificate and key to enable SSL encryption when using the MistServer interface or API. This needs to be set up as a boot parameter for MistServer as allowing this over the API would mean you could lock yourself out when making a mistake with no method of recovery. By setting it as a boot parameter we assume you can at least stop and edit the boot method, and thus fix whatever might be wrong.

The boot parameters you're looking for are:

--certificate or -x and --key or -X

--certificate, -x  (string) Path to certificate .pem file for TLS (HTTPS)
--key, -X          (string) Path to key .pem file for TLS (HTTPS)

For example, editing your service script boot parameters:

ExecStart=/usr/bin/MistController -c /etc/mistserver.conf --certificate /etc/letsencrypt/live/servername/fullchain.pem --key /etc/letsencrypt/live/servername/privkey.pem

To apply the changes MistServer will need to reboot.

tip
  • You might have made the interface completely inaccessible if you made big mistakes, double-check the certificate and paths!
  • You can also change the port number through --port number
  • Adding SSLKEYLOGFILE=/path/to/file for debugging SSL might be handy to add
  • MistServer does need a reload whenever the key or certificate change
    • This can be done manually by sending an USR1 command to the highest PID MistController

Using a reverse proxy​

If you're setting up a reverse proxy you can optionally proxy forward the API and interface as well. There are no big advantages or disadvantages to either method.