HTTPS Does Not Work For Management Server

[fnavidan]

I'm running CloudStack 4.22.0.0. I'm trying to enable https for management server UI. I have done following steps:

• Obtained a valid certificate for my desired UI hostname
• Converted certificate and private key to PKCS12 format
• Imported certificate and private key into keystore located at /etc/cloudstack/management/cloud.jks
• Enabled https and set keystore password in server.properties file.
• Opened port 8443 in firewall
• Changed ownership of /etc/cloudstack/management/cloud.jks to user 'cloud'

However, after restarting management server, UI is only accessible via http.

I've already looked into management server log and no https or keystore related error is found.

Any idea?

[dahampere]

I run 3 management nodes, but I use haproxy to offload SSL, while load-balancing https traffic to keep things simple on the cloudstack end. With the upcoming SSL certificate renewal changes, this might be the safest and cleanest option going forward.

[Flpvoigt]

CloudStack's embedded Jetty can terminate HTTPS directly, so HAProxy is optional. The first thing I would verify is that the settings are in the active file, /etc/cloudstack/management/server.properties, without a second conflicting entry:

https.enable=true
https.port=8443
https.keystore=/etc/cloudstack/management/cloud.jks
https.keystore.password=<the-keystore-password>

A few checks are important:

• Confirm the keystore contains a private-key entry, not only a trusted certificate: keytool -list -v -keystore /etc/cloudstack/management/cloud.jks.
• Make sure the keystore and every parent directory are readable/traversable by the account running cloudstack-management (changing only the file ownership may not be enough).
• Confirm the certificate SAN contains the hostname used in the browser, and that the keystore contains the full certificate chain.
• Restart the service and check the first startup lines in /var/log/cloudstack/management/management-server.log. They should show https.enable=true and https.port=8443. If the log still says https.enable=false, CloudStack is not reading the settings you edited.
• Test the endpoint directly with curl -vk https://:8443/client and verify that TCP/8443 is allowed between your browser and the management server.

The official configuration uses these same server.properties keys and requires the keystore to exist and be readable by the management server: https://docs.cloudstack.apache.org/en/4.20.1.0/installguide/optional_installation.html

If it still starts only on HTTP, please paste the startup line containing http.enable/https.enable and the output of keytool -list with passwords and private details redacted.

[nickaccuweb]

@fnavidan

Based on the steps you've already tried, I would suggest checking a couple of things.

CloudStack 4.22 uses embedded Jetty for the management UI. Enabling HTTPS doesn't automatically disable HTTP or redirect HTTP traffic to HTTPS.

First, try accessing the UI directly using:

https://your-hostname:8443/client

If that doesn't work, check whether CloudStack is actually listening on port 8443:

sudo ss -lntp | grep -E ':(8080|8443)\b'

Also, please verify the following settings in /etc/cloudstack/management/server.properties:

https.enable=true
https.port=8443
https.keystore=/etc/cloudstack/management/cloud.jks
https.keystore.password=YOUR_KEYSTORE_PASSWORD

One thing worth checking is the keystore itself. CloudStack may skip creating the HTTPS listener if the configured keystore file is missing. Make sure the file exists, is readable by the management service, and contains a valid PrivateKeyEntry with the certificate and private key.

You can verify it using:

sudo keytool -list -v -keystore /etc/cloudstack/management/cloud.jks

Also, check the management server startup logs to confirm whether https.enable=true is being picked up:

sudo grep "Initializing server daemon" /var/log/cloudstack/management/management-server.log | tail -5

If port 8443 is still not listening, could you share the output of the port check and the startup log entry? That should help narrow down whether the issue is with the HTTPS configuration or the keystore.

Alternatively, you can use Nginx or HAProxy for SSL termination and forward the traffic to CloudStack on port 8080. This is also a common approach for production setups.

CloudStack documentation for reference:
https://docs.cloudstack.apache.org/en/4.22.0.0/installguide/optional_installation.html#ssl-optional

Nick R
AccuWeb.Cloud

[fnavidan]

I have already managed this to work by offloading SSL connection to ngnix. It is much more easier to manage certificates when nginx is used as we can simply use standard PEM formatted certificate. It is also much easier to replace expired certificate.

[weizhouapache]

this is definitely the better solution