GeoServer over HTTPS on Ubuntu Apache

A self-signed certificate in front of GeoServer, using Ubuntu’s apache2 package. Tested on Amazon Lightsail (Ubuntu) with GeoServer 3.1: a WMS layer loaded in Globe. Use this when you cannot get a Let’s Encrypt or commercial certificate. The Windows path is Apache with XAMPP. Other options are on Working with your data.

What you will have

  • Apache answers https://YOURSERVER/ on port 443.
  • https://YOURSERVER/geoserver/ is Apache, forwarding to GeoServer on port 8080.
  • GeoServer advertises that HTTPS address, and allows https://globegeospatial.com (CORS).

These steps assume the Ubuntu Apache package apache2, not Amazon Linux httpd. GeoServer is already running at http://127.0.0.1:8080/geoserver/web. Replace YOURSERVER with the name you will type in the browser and in Globe.

Before you start

  1. On Lightsail, allow TCP 443 on the instance firewall. Do not open 8080 to the internet.
  2. On each Windows PC that will open Globe, map YOURSERVER to the server’s public IP in C:\Windows\System32\drivers\etc\hosts if DNS does not already do that.
203.0.113.10    YOURSERVER

Use the real IP. A certificate for YOURSERVER will not match a raw IP unless that IP is also listed in the certificate.

Part A — Certificate

On the Ubuntu server:

mkdir -p ~/geoserver-cert
cd ~/geoserver-cert

Create server.ext. Change the name and IP.

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = YOURSERVER
IP.1 = 203.0.113.10
openssl req -new -sha256 -nodes -out server.csr -newkey rsa:2048 -keyout server.key -subj "/CN=YOURSERVER"
openssl x509 -req -in server.csr -signkey server.key -out server.crt -days 365 -sha256 -extfile server.ext
sudo cp server.crt /etc/ssl/certs/geoserver.crt
sudo cp server.key /etc/ssl/private/geoserver.key
sudo chmod 640 /etc/ssl/private/geoserver.key

Keep server.crt. Each Windows PC that opens Globe must import that file. Do not copy server.key off the server.

Part B — Apache

sudo apt update
sudo apt install -y apache2
sudo a2enmod ssl proxy proxy_http headers

Use one port-443 site. Do not also enable default-ssl.

Create /etc/apache2/sites-available/geoserver-ssl.conf:

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName YOURSERVER

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/geoserver.crt
    SSLCertificateKeyFile /etc/ssl/private/geoserver.key

    ProxyPreserveHost On
    ProxyRequests Off

    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Port "443"

    ProxyPass        /geoserver/ http://127.0.0.1:8080/geoserver/
    ProxyPassReverse /geoserver/ http://127.0.0.1:8080/geoserver/
</VirtualHost>
</IfModule>
sudo a2ensite geoserver-ssl.conf
sudo a2dissite default-ssl.conf
sudo apache2ctl configtest
sudo systemctl reload apache2

configtest must say Syntax OK. This publishes the whole GeoServer site, including admin, on HTTPS. Fine on a private network. Do not leave the default admin password on a public IP.

Part C — Trust the certificate

On each Windows PC that will open Globe, import server.crt:

  1. Win+R → certlm.msc → Trusted Root Certification Authorities → All Tasks → Import.
  2. Quit the browser completely and open it again.
  3. Open https://YOURSERVER/geoserver/web. No certificate warning.

Part D — Public URL and CORS

In GeoServer’s global.xml (data directory, not the program folder):

<proxyBaseUrl>https://YOURSERVER/geoserver</proxyBaseUrl>
<useHeadersProxyURL>true</useHeadersProxyURL>

Restart GeoServer. GetCapabilities OnlineResource links must start with https://YOURSERVER/geoserver, not http://127.0.0.1:8080.

CORS on GeoServer 3

GeoServer 3 does not put a Jetty CORS filter in web.xml. Do not uncomment the Tomcat block. Sign in as admin / geoserver. The Linux user ubuntu is not a GeoServer user.

If Login on https://YOURSERVER/geoserver/web does nothing, the proxy is dropping the form (HTTPS in the browser, HTTP inside Apache). Tunnel to GeoServer and use the admin UI on localhost. From PowerShell, with the Lightsail .pem key: 

ssh -i "C:\path\to\lightsail.pem" -L 8080:127.0.0.1:8080 ubuntu@203.0.113.10

Leave that window open. A blank window after login is normal. Then open http://127.0.0.1:8080/geoserver/web.

  1. Open Security → CORS and enable it.
  2. Allowed origin patterns: https://globegeospatial.com
  3. Hold Ctrl and select GET, POST, and OPTIONS so all three stay highlighted. One click selects only one method, and WMS then still fails CORS.
  4. Hold Ctrl and select Origin, Content-Type, and Accept.
  5. Click Save, then restart GeoServer.

Content Security Policy and URL Checks are not required for Globe. They do not add Access-Control-Allow-Origin to layer responses.

Part E — Add the layer in Globe

  • WMS: https://YOURSERVER/geoserver/wms
  • WFS: https://YOURSERVER/geoserver/wfs

Use the HTTPS host, not port 8080. A mixed-content warning that the browser upgraded a request to HTTPS can still appear after the layer draws. Check GetCapabilities links are https:// so other browsers do not block them.

If something fails

  • Permission denied (publickey). Lightsail needs the instance .pem (ssh -i), user ubuntu, and the public IP. A blank window after a successful ssh is the tunnel — leave it open.
  • Login click does nothing on the HTTPS admin page. Use the SSH tunnel and http://127.0.0.1:8080/geoserver/web.
  • CORS still fails after restart. GET, POST, and OPTIONS must all be highlighted. Save, then restart the GeoServer process you actually edited.
  • Layer draws, console mentions mixed content. The browser upgraded an HTTP URL. Prefer fixing proxyBaseUrl so every OnlineResource is HTTPS.

Windows path: Apache with XAMPP. Overview: Working with your data.