TLS certificate

The portal is served over HTTPS only, on the AARVIEW_DOMAIN name. Two options for the certificate.

Default: a private authority

If traefik/tls/ holds no certificate, the installer creates:

• a private certificate authority (traefik/tls/ca.pem);
• the portal certificate for your domain (traefik/tls/cert.pem and its key key.pem);
• the authority’s key, moved out of the served folder: ca-key.DO-NOT-DEPLOY.pem.

Then:

1. Have your users’ browsers trust traefik/tls/ca.pem.
2. Keep ca-key.DO-NOT-DEPLOY.pem offline. It is not needed to run, only to sign a renewal.

Your own certificate

Before the first run of install.sh, put in traefik/tls/:

File	Content
cert.pem	the certificate, with the full chain
key.pem	its private key
ca.pem	the authority, only if a private authority signed it

The certificate must be valid for the domain: the installer checks it and stops otherwise. With a public certificate, ca.pem can stay empty.

What the portal serves

• Only AARVIEW_DOMAIN is served (strict SNI).
• TLS 1.2 or later, with forward-secret cipher suites.
• HSTS and the usual security headers.

TLS to your engines

AarView’s connections to the engines it reads (event store, endpoint manager, threat intelligence platform, Cortex) are verified. If one of them uses a private authority, see Existing engines.