SSL Certificate Setup

FlightPlan Server supports HTTPS for secure connections. This guide covers creating certificates for development and obtaining certificates for production.

Overview

HTTPS requires an SSL/TLS certificate. There are two scenarios:

Development: Use a self-signed certificate (free, created locally)
Production: Use a certificate from your corporate CA or a trusted certificate authority

⚠️ You only need then when trying to test SSL operation on the server. Otherwise just use HTTP on your laptop when writing code.

Creating a Self-Signed Certificate (Development)

Self-signed certificates are perfect for local development and testing. Browsers will show a warning, but the connection is still encrypted.

Step 1: Open PowerShell as Administrator

Right-click PowerShell and select "Run as administrator".

Step 2: Create the Certificate

Run this command to create a certificate valid for 2 years:

New-SelfSignedCertificate -DnsName "localhost" -CertStoreLocation "Cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(2) -FriendlyName "FlightPlan Dev"

You'll see output showing the certificate thumbprint:

Thumbprint                                Subject
----------                                -------
A1B2C3D4E5F6...                          CN=localhost

Copy the thumbprint - you'll need it in the next step.

Step 3: Export to PFX File

Replace YOUR_THUMBPRINT with the actual thumbprint from Step 2:

$cert = Get-ChildItem -Path "Cert:\LocalMachine\My\YOUR_THUMBPRINT"
$password = ConvertTo-SecureString -String "flightplan" -Force -AsPlainText
Export-PfxCertificate -Cert $cert -FilePath "C:\Dev\FlightPlan\server.pfx" -Password $password

Adjust the file path to your preferred location (e.g., your solution folder).

Step 4: Configure FlightPlan Server

1. Start FlightPlan Server
2. Click the Settings button
3. Check "Enable HTTPS"
4. Browse to the server.pfx file you created
5. Enter the password (flightplan)
6. Click "Validate Certificate" to verify
7. Set HTTPS Port to 8443 (or 443 if available)
8. Click Save

Step 5: Test

Restart the server. It should show "Mode: HTTPS (Production)" in the status area.

When you browse to the site, you'll see a browser warning about the certificate not being trusted. This is expected for self-signed certificates:

Chrome/Edge: Click "Advanced" → "Proceed to localhost (unsafe)"
Firefox: Click "Advanced" → "Accept the Risk and Continue"

Firewall Configuration

If the server can't bind to ports 80 or 443, you may need to open them in Windows Firewall. Run these commands as Administrator:

netsh advfirewall firewall add rule name="FlightPlan HTTP" dir=in action=allow protocol=tcp localport=80
netsh advfirewall firewall add rule name="FlightPlan HTTPS" dir=in action=allow protocol=tcp localport=443

For development ports (8080/8443), adjust the port numbers accordingly.

Troubleshooting Port Conflicts

If you see "Only one usage of each socket address is normally permitted", another process is using the port.

To find what's using a port:

netstat -ano | findstr ":443 "
tasklist /FI "PID eq <process_id>"

Common culprits include IIS, Apache, Skype, or another instance of FlightPlan Server.

For development, the easiest solution is to use alternate ports (8080/8443) in Settings.

Production Certificates

For production deployment, you'll need a certificate trusted by your users' browsers.

Corporate Environment

Most enterprises have an internal Certificate Authority (CA). Certificates from this CA are automatically trusted by corporate machines via Group Policy.

Request a certificate from your IT team with:

The server's machine name (e.g., us6sawn00752.wmservice.corpnet1.com)
Any DNS aliases/vanity URLs (e.g., opso.gsk.com)

These should be included as Subject Alternative Names (SANs) in a single certificate.

Public Certificates

For public-facing servers, you can purchase certificates from trusted CAs like DigiCert, Comodo, or Sectigo. Let's Encrypt offers free certificates but requires automated renewal every 90 days.

Certificate Requirements

Property	Development	Production
Format	PFX (PKCS#12)	PFX (PKCS#12)
DNS Names	localhost	Server FQDN + any aliases
Validity	1-2 years typical	1-2 years typical
Key Size	2048-bit minimum	2048-bit minimum
Trusted	No (self-signed)	Yes (CA-issued)

← Back to Guide