SSL configuration

Hello,

I’m a student in health information technology, and I’m currently doing a university project in which I need to install OpenEMR, and then use the REST and FHIR APIs. But I’m having trouble enabling SSL.

At the moment I’ve installed the OpenEMR Cloud - Express Edition AMI on an Amazon Web Service EC2 instance, which works fine. The incoming and outgoing security rules for my instance on AWS allow the HTTPS protocol.

In Admin → Config → Security, I’ve enabled the “Enable Client SSL” option.
In the “Path to CA Certificate File” field, I’ve specified the path to my “/domain.crt” file, and in the “Path to CA Key File” field, the path to my “/domain.key” file.

I generated the domain.crt and domain.key files with OpenSSL using this tutorial: https://www.baeldung.com/openssl-self-signed-cert

I’ve restarted my server, but the connection on the Chrome browser is still HTTP and not HTTPS (well, I’m guessing because the “HTTPS” in the URL is crossed out, and Chrome is telling me that the certificate is invalid, but the certificate information it provides doesn’t match the certificate I generated, so it must not take it into account).

So I don’t know what to do now. I wonder if the fact that the location of my certificate and key is on the / is a problem? But I don’t know where to move them. There’s the /etc/ssl/certs directory, but the files in it are all .pem. There’s also the Openssl.cnf configuration file, but I don’t really know what to edit in it, and I really don’t want to break everything.

I guess I missed a step in the whole procedure to enable SSL. Most of the information about OpenEMR and SSL I found online is about apache web server and I don’t think this is what I am using, but maybe I’m wrong ? “apache2 -v” command returns “Command ‘apache2’ not found”. The only thing I’m sure about is that I am using an ubuntu server :smiley:

As you may have noticed, I am quite a newbe in this whole SSL, web server, certificates … thing, so thank you sincerely in advance for anyone who takes the time to answer me.
Have a great day

hi @Kezimar you might have an easier time of things if you follow the easy dev setup which will spin up an ssl openemr at port 9300 on your localhost which you can then use to play with fhir api

Client SSL is 100% not what you want at all – that’s certificates that live on the client to authenticate them to the server. You’re after generic HTTPS.

If you’re using Express then you need to get your certificates into the OpenEMR container, because that’s where the webserver (which is Apache, yes) lives. Review https://github.com/openemr/openemr-devops/blob/master/docker/openemr/7.0.2/ssl.sh for more information on how we set the certificates up (which will advise you what files you need to replace in the container) and https://github.com/openemr/openemr-devops/blob/master/packages/lightsail/README.md#general for the care and feeding of container-based deployments in general.