I’m running DAML JSON Api and DAML on SQL process as two different pods in a kubernetes cluster. Trying to enable TLS communication using self signed certs for both the processes. Following commands to generate the certs, openssl genrsa -out ca.key 4096 openssl req -new -x509 -key ca.key -out ca.c…

Hi @senrav , welcome to the forum! The JSON API deliberately does not provide TLS support for its endpoints. The CLI parameters you used enable TLS for the connect between the JSON API and the ledger not for the endpoints of the JSON API itself. To secure the JSON API itself, you should put it behi…

Thanks @cocreature , for a quick reply. I’m having a similar setup, our UI is hosted using nginx and we have a reverse proxy configuration for our backend service and the JSON Api. The ingress will be like https://FQDN/v1 Is the X-Forwarded-Proto header, a must for the JSON Api for this to work? T…

You are expected to provide either X-Forwarded-Proto or Forwarded with an https URL. If you don’t, you will get a warning but things will still work. The cert and pem parameters passed to the JSON API are only used as client certificates for mutual TLS for the connection to DAML-on-SQL. They will b…

@senrav It is something to worry about. We made it a warning instead of an error to preserve compatibility for a version transition, but it has been warned about for a while, so could be changed to an error in any release, as mentioned in the PR that made it a warning . If you have reasonably straig…

If you are sure you’re setup is secure, you can also disable the warning by setting --allow-insecure-tokens. This less safe than setting the correct headers on your reverse proxy so only advised of headers are not an option.

[image] senrav: I’m having a similar setup, our UI is hosted using nginx and we have a reverse proxy configuration for our backend service and the JSON Api. The ingress will be like https://FQDN/v1 Is the X-Forwarded-Proto header, a must for the JSON Api for this to work? This is missing in my…

Thanks for the comments and suggestions. I solved it by using nginx as a sidecar container, enabling tls for the nginx and use localhost http to communicate with the json api.

Hi Senrav, How do i test it to know https is enabled for JSON API? Do we need to browse https://localhost:7575 ? But it doesn’t work

Issue enabling TLS for DAML JSON Api

App Development

Topic		Replies	Views
Does the HTTP JSON API support TLS? App Development	1	464	April 26, 2020
OpenSSL error when connecting json api jar to daml-on-sql jar with TLS App Development	2	966	April 27, 2021
How to test Apache Reverse proxy enablement for JSON API App Development daml , json-api , canton	0	356	April 17, 2023
How do i enable HTTPS for Daml JSON API using Apache Reverse Proxy App Development json-api	2	278	March 30, 2023
DAML JSON-API Query error " Endpoints.ServerError: org.postgresql.util.PSQLException: The server does not support SSL." App Development	14	876	July 2, 2020

Issue enabling TLS for DAML JSON Api

Related topics