SSL/TLS Usage

HTTPS Requirement
Certificates

Cockpit usually requires that web browsers communicate with it using HTTPS, for security reasons.

HTTPS Requirement

Cockpit listens for both HTTP and HTTPS connections on the same port, by default 9090. If an HTTP connection is made, Cockpit will redirect that connection to HTTPS. There are some exceptions:

  • If an HTTP connection comes from 127.0.0.0/8, then Cockpit will allow communication without redirecting to HTTPS.

  • Certain URLs, like /ping are not required to use HTTPS.

Certificates

Cockpit will load a certificate from the /etc/cockpit/ws-certs.d directory. It will use the first file with a .cert extension in alphabetical order.

If no certificate is found, a self-signed certificate is created.