SSL/TLS Usage

HTTPS Requirement
Certificates
SSL Versions and Ciphers

Cockpit usually requires that web browsers communicate with it using HTTPS, for security reasons.

HTTPS Requirement

Cockpit listens for both HTTP and HTTPS connections on the same port, by default 9090. If an HTTP connection is made, Cockpit will redirect that connection to HTTPS. There are some exceptions:

  • If an HTTP connection comes from 127.0.0.0/8, then Cockpit will allow communication without redirecting to HTTPS.

  • Certain URLs, like /ping are not required to use HTTPS.

Certificates

Cockpit will load a certificate from the /etc/cockpit/ws-certs.d directory. It will use the first file with a .cert extension in alphabetical order.

If no certificate is found, a self-signed certificate is created.

SSL Versions and Ciphers

By default Cockpit will only use modern secure ciphers and versions of TLS. In particular SSL v3.0 is disabled by default, as well as the RC4 cipher.

If you wish to enable these legacy protocols and algorithms you can do so by passing an environment variable to cockpit-ws. Place the following in the /etc/systemd/system/cockpit.service.d/ssl.conf file. Create the file and directories in that path which don't already exist.

[Service]
Environment=G_TLS_GNUTLS_PRIORITY=NORMAL:%COMPAT

The environment variable value is a GnuTLS priority string.