GeoServer over HTTPS with a self-signed certificate

A Windows walkthrough for Apache (XAMPP) in front of GeoServer. Use this when you cannot get a Let’s Encrypt or commercial certificate. A public certificate is still the better choice when you can obtain one. See Working with your data for the other HTTPS options.

Who this is for

You already run GeoServer on this PC (usually http://127.0.0.1:8080/geoserver) and Apache from XAMPP. Layers work in GeoServer’s own pages, but Globe is served over HTTPS (https://globegeospatial.com). Browsers block that mix: an HTTPS page will not call an HTTP GeoServer.

This guide puts HTTPS on Apache and proxies /geoserver to the local GeoServer. Globe then uses https://YOURSERVER/geoserver/… instead of http://127.0.0.1:8080/geoserver/….

A self-signed certificate is fine on a lab or office network. It is not a public certificate. Every PC that opens Globe must trust this certificate, and the hostname in the certificate must be the hostname people type in the browser.

What you will have at the end

  • Apache answers https://YOURSERVER/ (port 443).
  • https://YOURSERVER/geoserver/ is Apache, forwarding to GeoServer on port 8080.
  • GeoServer tells clients its public address is https://YOURSERVER/geoserver.
  • GeoServer allows the browser on https://globegeospatial.com to load layers (CORS).

Replace YOURSERVER everywhere with the name this computer uses on your network (the name in https://YOURSERVER/geoserver/web). Use the same spelling in the certificate, in Apache, and in Globe. If people will also use localhost, that name is already included below.

Before you start

  1. Confirm GeoServer works locally: http://127.0.0.1:8080/geoserver/web
  2. Confirm Apache from XAMPP starts.
  3. If you already proxy GeoServer on port 80, keep that httpd-vhosts.conf file. You will copy those ProxyPass lines into the HTTPS host. You do not need a second, different proxy path.
  4. Back up these files before editing them:
    • C:\xampp\apache\conf\extra\httpd-ssl.conf
    • C:\xampp\apache\conf\ssl.crt\server.crt
    • C:\xampp\apache\conf\ssl.key\server.key
    • GeoServer’s global.xml (in the GeoServer data directory)
    • GeoServer’s web.xml (webapps\geoserver\WEB-INF\web.xml)

Copy the originals aside (for example server.crt.bak). Do not rename httpd-ssl.conf itself. Apache still has to load that filename.

Part A — Create a self-signed certificate

A1. Make a folder for the certificate files

Create C:\myserver.

All of the key and certificate files will be created here, then copied into Apache. Do not generate them inside Apache’s bin folder.

A2. Create C:\myserver\server.ext

This file tells OpenSSL which hostnames the certificate is valid for. Chrome and Edge require these names (Subject Alternative Name). CN alone is not enough.

Put this in server.ext. Change DNS.2 to your server name. Add DNS.3 or IP.1 only if people will use those names or addresses.

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost
DNS.2 = YOURSERVER

If you also connect by IP address, add a line under [alt_names]:

IP.1 = 192.168.1.50

Use your real IP. A certificate for YOURSERVER will not match https://192.168.1.50 unless that IP is listed.

A3. Point OpenSSL at XAMPP’s config, then create the key

OpenSSL ships with XAMPP at C:\xampp\apache\bin\openssl.exe.

XAMPP’s OpenSSL often looks for openssl.cnf in the wrong default folder. Set this in the same Command Prompt window before you run openssl (this lasts only for that window): 

cd C:\myserver
set OPENSSL_CONF=C:\xampp\apache\conf\openssl.cnf

Create the private key and certificate request. Change YOURSERVER to the same name as DNS.2:

C:\xampp\apache\bin\openssl.exe req -new -sha256 -nodes -out server.csr -newkey rsa:2048 -keyout server.key -subj "/CN=YOURSERVER"

You should now have these files in C:\myserver:

  • server.key — private key. Keep this on the server; do not email it.
  • server.csr — request used in the next step.

A4. Sign the certificate

Still in C:\myserver, with OPENSSL_CONF set:

C:\xampp\apache\bin\openssl.exe x509 -req -in server.csr -signkey server.key -out server.crt -days 365 -sha256 -extfile C:\myserver\server.ext

Success looks like:

Certificate request self-signature ok
subject=CN = YOURSERVER

You now have server.crt. It expires in 365 days. When it expires, repeat Part A and copy the new files into Apache again (Part B). Each PC that imported the old certificate must import the new server.crt (Part C).

Part B — Apache: HTTPS and the GeoServer proxy

Use one HTTPS site (port 443). Put the certificate and the GeoServer proxy in that same VirtualHost. Do not create a second VirtualHost for the proxy.

B1. Copy the certificate into Apache

XAMPP’s folders are ssl.crt and ssl.key:

  • Copy C:\myserver\server.crt to C:\xampp\apache\conf\ssl.crt\server.crt
  • Copy C:\myserver\server.key to C:\xampp\apache\conf\ssl.key\server.key

If those files already exist, your backups from “Before you start” are the ones to restore if you need to undo this.

B2. Turn on SSL and the proxy modules

In C:\xampp\apache\conf\httpd.conf, these lines must be uncommented (no # at the start). XAMPP often has them commented until SSL is used:

LoadModule ssl_module modules/mod_ssl.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule headers_module modules/mod_headers.so

Also uncomment:

Include conf/extra/httpd-ssl.conf

If GeoServer already works through Apache on port 80, the proxy modules are probably already enabled. Still check headers_module. You will use it so GeoServer sees that the public request was HTTPS.

B3. Edit the HTTPS virtual host

Open C:\xampp\apache\conf\extra\httpd-ssl.conf. Find the existing <VirtualHost _default_:443> block. Edit that block. Do not add a second one.

It should include your server name, the certificate you just copied, and the same ProxyPass lines you already use for GeoServer on port 80. Example (XAMPP paths; a standalone Apache install is the same idea with its own conf folder): 

<VirtualHost _default_:443>
    DocumentRoot "C:/xampp/htdocs"
    ServerName YOURSERVER

    SSLEngine on
    SSLCertificateFile "conf/ssl.crt/server.crt"
    SSLCertificateKeyFile "conf/ssl.key/server.key"

    ProxyPreserveHost On
    ProxyRequests Off

    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Port "443"

    ProxyPass        /geoserver/ http://127.0.0.1:8080/geoserver/
    ProxyPassReverse /geoserver/ http://127.0.0.1:8080/geoserver/
</VirtualHost>
  • ServerName must match a name in server.ext (YOURSERVER or localhost).
  • Keep the slashes on both sides of ProxyPass the same way. /geoserver/ to http://127.0.0.1:8080/geoserver/ is the usual GeoServer path. If yours is different, copy the lines that already work in httpd-vhosts.conf.
  • Leave GeoServer itself on HTTP port 8080. Apache is the HTTPS front door.
  • This publishes the whole GeoServer site, including the admin page, on https://YOURSERVER/geoserver/. That is fine on a private network. Do not open port 443 to the public internet with the default GeoServer admin password.

httpd-ssl.conf should already contain Listen 443. If Apache will not start and the error is about port 443, that line is missing or another program is using 443.

B4. Restart Apache

Use the XAMPP control panel: Stop Apache, then Start. If it fails, read C:\xampp\apache\logs\error.log. A typical cause is a certificate path that does not match the file you copied.

Part C — Trust the certificate on each PC that will use Globe

A self-signed certificate is not trusted until you install it. GeoServer’s preview on this PC can look fine while another PC, or Globe, still blocks the connection.

C1. Import server.crt into Windows

On each PC that will open Globe (including this server, if you test in a browser here):

  1. Press Win+R, type certlm.msc, and press Enter. Use certlm.msc (this computer), not certmgr.msc (current user only).
  2. In the left tree, right-click Trusted Root Certification Authorities.
  3. All Tasks → Import.
  4. Browse to server.crt (you may need to show all files, not only .cer).
  5. Choose “Place all certificates in the following store”.
  6. The store must be Trusted Root Certification Authorities.
  7. Finish.

C2. Restart the browser

Close every window of that browser, then open it again. A refresh is not enough. Old certificate errors stay cached.

C3. Make sure the name resolves

https://YOURSERVER/ only works if that PC can turn YOURSERVER into this computer’s IP address.

  • On a domain network, DNS may already do that.
  • On a small LAN, add a line to the hosts file on each PC (edit as Administrator): C:\Windows\System32\drivers\etc\hosts
192.168.1.50    YOURSERVER

C4. Confirm HTTPS before you touch Globe

In the browser, open https://YOURSERVER/geoserver/web.

You want the GeoServer page with no certificate warning. If the browser still warns:

  • The name in the address bar is not in server.ext (YOURSERVER vs an IP, or a typo).
  • The certificate was imported into the wrong store.
  • The browser was not fully restarted.

Part D — Tell GeoServer its public address is HTTPS

D1. Proxy base URL

Stop GeoServer. Edit global.xml in the GeoServer data directory (not the program folder). Search for proxyBaseUrl. Set it to the HTTPS address Apache serves, with no trailing slash: 

<proxyBaseUrl>https://YOURSERVER/geoserver</proxyBaseUrl>

In the same file, set:

<useHeadersProxyURL>true</useHeadersProxyURL>

Save the file and start GeoServer.

Why this matters: GetCapabilities must advertise https://YOURSERVER/geoserver/…. If those links still say http://127.0.0.1:8080/geoserver/…, Globe will try the HTTP address and the browser will block it. Open this in the browser and search the XML for OnlineResource: 

https://YOURSERVER/geoserver/ows?service=WMS&request=GetCapabilities

Every link you will use should start with https://YOURSERVER/geoserver.

D2. Allow Globe to call your server (CORS)

Globe and your GeoServer are different sites. The browser will only load tiles and features if GeoServer explicitly allows https://globegeospatial.com. How you set that depends on the GeoServer version.

GeoServer 3 and later

Jetty 12 removed the old web.xml CORS filter. A 3.x web.xml has no Jetty cross-origin block. Do not uncomment the remaining Tomcat block on a normal Windows install (GeoServer on port 8080). Use the admin UI instead. A new install signs in as admin / geoserver.

  1. Open http://127.0.0.1:8080/geoserver/web on the GeoServer PC and sign in. If Login on the public https://YOURSERVER/geoserver/web page does nothing, that is a proxy CSRF mismatch — use the localhost address, not the HTTPS proxy, for this step.
  2. Open Security → CORS. Enable it.
  3. Allowed origin patterns: https://globegeospatial.com
  4. Allowed methods: hold Ctrl and select GET, POST, and OPTIONS so all three stay highlighted. Clicking one row clears the others. A list that only shows those names is not the same as a multi-selection.
  5. Allowed headers: hold Ctrl and select Origin, Content-Type, and Accept.
  6. Click Save, then restart GeoServer. The page says the restart is required.

Content Security Policy and URL Checks on the same admin menu are not a substitute. They do not add Access-Control-Allow-Origin to WMS or WFS responses.

GeoServer 2.x

Stop GeoServer. Open <geoserver>\webapps\geoserver\WEB-INF\web.xml and search for cross-origin.

Uncomment the Jetty filter and its filter-mapping (class org.eclipse.jetty.servlets.CrossOriginFilter). Do not uncomment the Tomcat block unless GeoServer is deployed as a Tomcat application.

In that Jetty filter, set allowed origins to Globe only:

<init-param>
  <param-name>allowedOrigins</param-name>
  <param-value>https://globegeospatial.com</param-value>
</init-param>

Leave the other Jetty init-param lines uncommented if they were part of that filter (methods and headers). Save web.xml and start GeoServer. Apache does not need a restart for this step. GeoServer does.

Part E — Add the layer in Globe

In Globe, Add Layers, use the HTTPS address, not port 8080 and not http://.

  • WMS: https://YOURSERVER/geoserver/wms
  • WFS: https://YOURSERVER/geoserver/wfs

Or the GetCapabilities URL, if you prefer to paste that. The host must be YOURSERVER (a name on the certificate), and the page must already open without a certificate warning on that PC. Fetch layers, then add the ones you need.

If something fails

  • Certificate warning in the browser. The hostname does not match server.ext, or server.crt is not in Trusted Root on that PC. Fix that before testing Globe.
  • Apache will not start. Read C:\xampp\apache\logs\error.log. Check SSLCertificateFile / SSLCertificateKeyFile and that only one process is listening on 443.
  • https://YOURSERVER/geoserver/web does not open, but http://127.0.0.1:8080/geoserver/web does. The proxy lines are missing, pointed at the wrong port, or Apache was not restarted. GeoServer itself is fine.
  • GetCapabilities still lists http://127.0.0.1:8080. proxyBaseUrl was not saved in the data directory GeoServer is actually using, or GeoServer was not restarted.
  • GeoServer preview works, Globe does not. In the browser’s developer tools (Network), a failed request is usually mixed content (a URL in Globe is still http://), a certificate this PC does not trust, or CORS. On GeoServer 3, CORS is Security → CORS with GET, POST, and OPTIONS all highlighted, then a restart. On GeoServer 2, it is the Jetty block in web.xml.
  • Mixed-content warning, but the layer still draws. Some browsers upgrade an http:// request to HTTPS automatically. The map can work. Still check GetCapabilities OnlineResource links are https:// so other browsers do not block them.
  • Works on this PC, not on a teammate’s PC. They need the same three things: hosts/DNS for YOURSERVER, server.crt in Trusted Root, and a restarted browser.
  • After a year. The certificate from -days 365 expires. Repeat Part A, copy the new crt/key into Apache, restart Apache, and import the new server.crt on each PC.

Back to Working with your data for Let’s Encrypt, a commercial certificate, or another web server.