Documentation forOrion Platform

Configure the Orion Web Console to use HTTPS

This topic applies to all Orion Platform products.

SolarWinds Orion Platform products support binding Secure Sockets Layer (SSL) certificates to your Orion server port to enable secure communications with the Orion Web Console.

  • SolarWinds recommends that you install a certificate from a certificate authority before adding the bindings to the website, and that you enable the certificate auto enrollment group policy to prevent the certificate from generating browser errors.
  • This information refers to SolarWinds products running on Orion Platform version 2017.1 or later. For configuration steps for older versions of the product, see Configure the Orion Web Console for SSL (deprecated).

Due to security concerns, SolarWinds recommends that you disable SSL v3.0 and earlier.

Configure the Orion Web Console for HTTPS during the installation

When running the Configuration wizard, select the Enable HTTPS option on the Website Settings screen.

Decide the whether you want to bind an existing certificate to your Orion server port or create a new certificate.

Use a previously installed SSL certificate

  1. On the Website Settings screen of the Configuration wizard, select Enable HTTPS.

  2. Choose the certificate you want to use. Certificates with a green check mark are least likely to generate browser warnings.

  3. If you want to use Smart Card (CAC/PKI) login, select the Enable automatic login using Windows Authentication box. For further configuration details, see Set up SSL and enable Smart Card (CAC/PKI) user authentication for Orion Web Console.

  4. Complete the Configuration wizard.

The Configuration Wizard enables the Orion Web Console to use SSL for the specified port, adds the website binding to the Orion Web Console, and forces the website to use HTTPS by default.

After the Configuration wizard is finished, the Orion Web Console opens using HTTPS. If you used a certificate with a green check mark next to it, there should be no browser warnings. If you used a certificate with a yellow warning sign next to it, you may have a browser warning.

Generate a self-signed certificate

You can generate a self-signed certificate directly in the Configuration wizard.

  1. On the Website Settings screen of the Configuration wizard, select Enable HTTPS.

  2. Expand the drop-down list, scroll to the bottom, and select Generate Self-Signed Certificate.

  3. If you want to use Smart Card (CAC/PKI) login, select the Enable automatic login using Windows Authentication box. For further configuration details, see Set up SSL and enable Smart Card (CAC/PKI) user authentication for Orion Web Console.

  4. Complete the Configuration wizard.

A self-signed certificate is issued to the machine host name or fully qualified domain name (FQDN) when the computer is part of a domain, and the certificate is added to the trusted certificate store. After the Configuration wizard is finished, the Orion Web Console opens using HTTPS.

The certificate authority for self-signed certificates is the computer hosting your Orion server. Depending on your security and group policy settings, the Orion Web Console may generate browser errors because the certificate was not issued by a known certificate authority.

Certificate categories

Make sure that the certificate contains SAN (Subject Alternative Name) extension in form of DnsName=OrionDomainName. Otherwise, some browsers, such as Google Chrome or new Microsoft Edge, might evaluate it as invalid.

Certificate category Icon Explanation
Valid

The certificate is valid and should not generate browser warnings. Certificates are marked green if they meet one or more of the following criteria:

  • The certificate's Issued To (CN) field fully matches the server's FQDN
  • The certificate's Issued To (CN) field partially matches the server's FQDN using wildcards
  • The certificate's Issued To (CN) field partially matches the server's FQDN
May generate warnings

The certificate can be used, but may generate browser warnings. Certificates are marked yellow if they meet one of the following criteria, ordered from least likely to most likely to generate browser errors:

  • Self-signed certificates where the Issued To and Issued By fields match the server's FQDN
  • Certificates issued to the IP address instead of the host name or FQDN
  • Certificates issued to a computer with different hostname
Invalid n/a

The following certificates are considered to be invalid:

  • Client certificates
  • Certificates that have expired
  • Certificates that use an untrusted authority

You cannot use invalid certificates, and thus they are not available in the drop-down list on the Website Settings page of the Configuration wizard.

Configure Orion Web Console for HTTPS after you install an Orion Platform product

You can still use the Configuration Wizard to add the binding to your Orion Web Console after you have installed a SolarWinds Orion product.

You must install an SSL certificate on the Orion server before performing the following steps.

  1. Log in to your Orion server as an administrator.

  2. Run the Configuration wizard from the Start menu.

  3. Select Configure the website, and click Next.

  4. Clear the Skip website binding option.

  5. Select Enable HTTPS.

  6. Choose the installed certificate.

    If the certificate does not show in the list, review how certificates are categorized.

  7. If you want to use Smart Card (CAC/PKI) login, select the Enable automatic login using Windows Authentication box. For further configuration details, see Set up SSL and enable Smart Card (CAC/PKI) user authentication for Orion Web Console.

  8. Complete the Configuration wizard.