|
0
|
1 .. highlight:: bash
|
|
|
2 .. _https:
|
|
|
3
|
|
|
4 HTTPS encryption with Orthanc
|
|
|
5 =============================
|
|
|
6
|
|
|
7 It is highly desirable to enable HTTPS (SSL) encryption with Orthanc
|
|
|
8 to protect its REST API, as it provides access to medical
|
|
|
9 information. To this end, you have two possibilites:
|
|
|
10
|
|
|
11 1. Put Orthanc behind an enterprise-ready HTTPS server such as
|
|
|
12 :ref:`Apache <apache>` or :ref:`nginx <nginx>`.
|
|
|
13 2. For simple deployments, use Orthanc :ref:`built-in HTTPS server <https-builtin>`.
|
|
|
14
|
|
|
15 **You should always favor the first option**. The second option might make
|
|
|
16 sense in the context of an hospital Intranet, i.e. the Orthanc server
|
|
|
17 is not publicly accessible from the Internet.
|
|
|
18
|
|
|
19
|
|
|
20 .. _https-builtin:
|
|
|
21
|
|
|
22 Built-in encryption
|
|
|
23 -------------------
|
|
|
24
|
|
|
25 To enable the built-in HTTP server of Orthanc, you need to:
|
|
|
26
|
|
|
27 1. Obtain a `X.509 certificate <http://en.wikipedia.org/wiki/X.509>`_
|
|
|
28 in the `PEM format
|
|
|
29 <http://en.wikipedia.org/wiki/X.509#Certificate_filename_extensions>`_.
|
|
|
30 2. Prepend this certificate with the content of your private key.
|
|
|
31 3. Modify the ``SslEnabled`` and ``SslCertificate`` variables in the
|
|
|
32 :ref:`Orthanc configuration file <configuration>`.
|
|
|
33
|
|
|
34 Here are simple instructions to create a self-signed SSL certificate
|
|
|
35 that is suitable for test environments with the `OpenSSL
|
|
|
36 <http://en.wikipedia.org/wiki/Openssl>`_ command-line tools::
|
|
|
37
|
|
|
38 $ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout private.key -out certificate.crt
|
|
|
39 $ cat private.key certificate.crt > certificate.pem
|
|
|
40
|
|
|
41 Some interesting references about this topic can be found `here
|
|
|
42 <http://devsec.org/info/ssl-cert.html>`__, `here
|
|
|
43 <http://www.akadia.com/services/ssh_test_certificate.html>`__, and
|
|
|
44 `here
|
|
|
45 <http://stackoverflow.com/questions/991758/how-to-get-an-openssl-pem-file-from-key-and-crt-files>`__.
|
