Setting Up HTTPS for Core Hub Web UI and Secure Web Socket Connections

This guide explains how to enable and configure HTTPS with TLS encryption for secure connections to the Gluesync Core Hub web interface and secure web socket connections between nodes.

Overview

By default, Gluesync CoreHub runs with TLS encryption enabled, with a built-in self-signed certificate coming with the trial kit for Docker. To ensure secure communications, you should generate your own certificates and configure CoreHub to use TLS encryption.

The process involves the following steps:

  1. Generating the required SSL certificates

  2. Configuring CoreHub to use TLS encryption (enabled by default under any docker-compose kit)

  3. Customizing the security configuration file

Generating SSL Certificates

While the kit comes with self-signed certificates, you may want to generate your own. Here’s how to create them:

#!/bin/bash
# Create a directory for certificates
mkdir certs
cd certs

# Generate root CA key (you'll be prompted for a password)
openssl genrsa -des3 -out rootCA.key 4096

# Generate root certificate
openssl req -x509 -new -nodes \
  -key rootCA.key \
  -sha256 \
  -days 1825 \
  -out rootCA.crt \
  -subj "/C=IT/ST=Italy/O=YourOrganization/L=YourCity/OU=YourUnit/CN=gluesync.com"

# Generate Gluesync key
openssl genrsa -out gluesync.com.key 2048

# Generate Certificate Signing Request (CSR)
openssl req -new -sha256 \
  -key gluesync.com.key \
  -subj "/C=IT/ST=Italy/O=YourOrganization/L=YourCity/OU=YourUnit/CN=gluesync.com" \
  -out gluesync.com.csr

# Generate Gluesync certificate
openssl x509 -req \
  -in gluesync.com.csr \
  -CA rootCA.crt \
  -CAkey rootCA.key \
  -CAcreateserial \
  -out gluesync.com.crt \
  -days 1825 \
  -sha256

# Create PKCS12 keystore
openssl pkcs12 -export \
  -name gluesync \
  -in gluesync.com.crt \
  -inkey gluesync.com.key \
  -out gluesync.com.p12

# Convert to Java KeyStore (JKS)
keytool -importkeystore \
  -destkeystore gluesync.com.jks \
  -srckeystore gluesync.com.p12 \
  -srcstoretype pkcs12 \
  -alias gluesync
Remember to replace the certificate subject information (/C=IT/ST=Italy/O=YourOrganization/…​) with your organization’s details.

Extracting PEM files

If you are using a reverse proxy such as Traefik in front of Core Hub, you will need to extract the certificate and private key in PEM format from the .p12 keystore generated in the previous step.

# Extract the certificate (-cert.pem)
openssl pkcs12 -in gluesync.com.p12 -clcerts -nokeys -out gluesync.com-cert.pem

# Extract the private key (-key.pem) without encryption
openssl pkcs12 -in gluesync.com.p12 -nocerts -nodes -out gluesync.com-key.pem

This will produce:

  • gluesync.com-cert.pem — X.509 certificate in PEM format

  • gluesync.com-key.pem — unencrypted private key in PEM format

The -nodes flag is critical when extracting the private key. Without it, OpenSSL encrypts the exported PEM private key by default and prompts for a passphrase, producing an encrypted key (-----BEGIN ENCRYPTED PRIVATE KEY-----) that our reverse proxy (Traefik) cannot read. With -nodes, the key is written as an unencrypted PEM private key (-----BEGIN PRIVATE KEY-----), which is the format expected.
Keep the same file names as the .pem files already present in the Gluesync installation folder. The .pem certificates are located in the shared folder of your Gluesync installation. By preserving the original file names, you can simply replace the existing files without needing to edit the docker-compose.yml configuration to reference new file names. On older Windows installations, the .pem files could also be duplicated in the proxy folder — make sure to replace them in both locations.
Replace gluesync.com in the file names and commands with the actual domain name you used when generating the certificate. The hostname in the certificate must match the domain that you are using to reach Core Hub.

Enabling TLS in Core Hub

To enable TLS encryption, modify your Core Hub service definition in the docker-compose or in your Kubernetes configuration file:

gluesync-core-hub:
  image: molo17/gluesync-core-hub:LATEST
  environment:
    - type=corehub
    - ssl_enabled=true # Enable TLS
    - LOG_CONFIG_FILE=/opt/gluesync/shared/logback.xml
  volumes:
    - ./shared:/opt/gluesync/shared:rw
    # ... other volume mappings ...
The ssl_enabled environment variable is set to true to enable TLS encryption. The default HTTPS port is 1717.
Repeat this step for each node and agent present in your deployment.

Important Configuration Notes

  1. Set ssl_enabled=true in the environment variables

  2. Ensure the JKS file (gluesync.com.jks) is mounted correctly in the container

  3. The default HTTPS port is 1717

Customizing the Security Configuration File

To ensure that all nodes share the same secret for the TLS certificates, you need to customize the security configuration file. This file should include the following settings:

{
  "ssl": {
    "sslCertificatePath": "/opt/gluesync/shared/gluesync.com.jks",
    "certificateAlias": "gluesync",
    "certificatePassword": "gluesync",
    "certificateKeyPassword": "gluesync"
  }
}

Make sure to mount this configuration file on each node. This setup not only secures the communication between the client (browser) and the Core Hub UI but also secures the communication between each node by enabling WSS (WebSocket Secure).

This file should be named security-config.json and placed in the /opt/gluesync/shared directory, just like the following example:

volumes:
  - ./security-config.json:/opt/gluesync/shared/security-config.json

Verifying the Configuration

After enabling TLS:

  1. Restart the Core Hub service

  2. Access the web UI using https:// instead of http://

  3. If using self-signed certificates, you may need to accept the security warning in your browser

Troubleshooting

  • If you can’t connect after enabling TLS, verify that:

    • The JKS file is properly mounted

    • The ssl_enabled environment variable is set to true

    • The correct port is exposed in your docker-compose configuration