HTTPS Configuration for the Web Interface

By default, the program's built-in web interface runs over the non-secure HTTP protocol. This means that data sent from the built-in web server to the browser can be intercepted and viewed without difficulty. This data includes device IP and MAC addresses, switch names and locations, the program event log, check parameters, and so on. If you use the web interface on a protected internal network where every user is allowed to access this data, you do not need to worry about this.

However, if you want to connect to the program's web server over open networks (the Internet), you definitely need to use the secure HTTPS protocol to access the information in a browser. HTTPS encrypts the data sent from the web server to the browser using a key and a certificate issued for the domain by a certificate authority. The certificate has a digital signature that protects it from forgery.

Using the Program Web Interface over a Secure Connection with the Self-Signed Demo Certificate

The program's web server (Jetty) is already configured to work over HTTPS. By default, it is available on port 8443, which can be changed in the Jetty settings.

Configuration files:

1. web\base\start.d\http-config.ini
   parameter jetty.httpConfig.securePort
   
2. web\base\start.d\ssl.ini
   parameter jetty.ssl.port=8443
   

To switch the Jetty server to HTTPS, open the folder c:\Program Files (x86)\10-Strike Network Monitor Pro\web\base\start.d\, open the https.ini file, uncomment the --modules=https parameter, and restart the Jetty Service service. By default this is already done, so the web UI is also available at https://localhost:8443/netmonitor/netmonitor.html?locale=en.

Start a browser and enter the following address:

https://localhost:8443/netmonitor/netmonitor.html?locale=en

The certificate supplied with the program is self-signed — that is, it was not issued by a certificate authority. This demo certificate was generated with the free open-source utility openssl.exe. It is intended to demonstrate HTTPS access to the built-in web interface and must not be used on unprotected networks because it is not secure. However, if you do not have your own certificate issued for your domain and company, you can use this demo certificate on internal networks. You will need to add an exception so that the browser trusts the certificate.

This is easy to do. When you open the web interface URL, the browser shows a warning that the connection is not secure. Follow these steps to bypass the warning and avoid seeing it again (Firefox example):

1. Click Advanced.
   
   

   

   
   
   
2. Click Add Exception….
   
   

   

   
   
   
3. In the dialog that opens, click Confirm Security Exception.
   
   

   

   
   
   

After that, the browser continues loading the web interface, and you can work with it over encrypted HTTPS just as you would with your own certificate. Because the browser cannot verify the authenticity of the installed certificate, it will still treat it as insecure.

! Do not use the demo certificate to access the program web interface over unprotected networks (for example, over the Internet)!

Installing a Signed Certificate in 10 Steps

If you have your own certificate issued and signed by a certificate authority, you can use it with the program by following these steps:

1. Your certificate authority should provide two files: a signed certificate (.crt) and a key (.key). Copy them to the folder c:\Program Files (x86)\10-Strike Network Monitor Pro\web\base\Certificate\ and rename them to jetty.crt and jetty.key respectively. The jetty.crt file must be in PEM format, roughly like this:
   
   

   -----BEGIN CERTIFICATE-----
   MIIDzDCCArQCCQCXtcBm22AETzANBgkqhkiG9w0BAQQFADCBpzEbMBkGA1UEChMS
   MTAtU3RyaWtlIFNvZnR3YXJlMSQwIgYJKoZIhvcNAQkBFhVzdXBwb3J0QDEwLXN0
   ...
   xEDGxy6A+grWMG7p8Ct/KIIz0dUeoJRw8kQvV/eZsOIBiWfVo8OsEdBgShobZupG
   560vPhTn6pode036YdDHMQ==
   -----END CERTIFICATE-----

   
   
2. Add the \bin directory of your installed Java to the PATH environment variable. For example, c:\Program Files (x86)\Java\jre1.8.0_181\bin\.
3. Add the \bin directory of your installed OpenSSL package to the PATH environment variable. For example, c:\Program Files (x86)\OpenSSL-Win32\bin\.
4. Open the 1_import_crt.bat file in Notepad. You will see something like this:
   

   keytool -genkeypair -alias jetty -keyalg RSA -keystore keystore.p12 -storetype PKCS12 -validity 365 -storepass netmonitor -keypass netmonitor -ext "SAN=dns:localhost,ip:127.0.0.1" -dname "CN=localhost, OU=Dev, O=Tenstrike, L=Saratov, ST=Saratov, C=RU"
   

   Replace the default values with the data from your certificate and domain.

   Set your own keystore passwords (default is netmonitor):

   -storepass netmonitor -keypass netmonitor

   Instead of

   dns:localhost,ip:127.0.0.1

   enter the IP address and domain name for which the certificate was issued.

   Update the highlighted parameters in this string with your data:

   SAN=dns:localhost,ip:127.0.0.1" -dname "CN=localhost, OU=Dev, O=Tenstrike, L=Saratov, ST=Saratov, C=RU

   Save the file.

    

5. Run 1_import_crt.bat.
   A new keystore.p12 file should appear in the same folder — this is the Jetty key and certificate store that already contains your certificate.
   
   

   

    

   
   
6. Next, convert the .crt and .key files to PKCS12 format before loading them into the created store. Run 2_make_pks.bat. Enter the keystore password you set earlier (default netmonitor), set an export password, and confirm it. A new jetty.pkcs12 file should appear in the same folder — a combined key and certificate file.
   
   

   

    

   
   
   
7. Load it into the store by running 3_load_keys.bat. Enter the keystore password twice. As a result, the size and date of keystore.p12 in the same folder should change. This file is automatically copied to c:\Program Files (x86)\10-Strike Network Monitor Pro\web\base\etc\ — verify that this happened (by the file date).
   
   

   

    

   
   
   
8. Open the file c:\Program Files (x86)\10-Strike Network Monitor Pro\web\base\start.d\ssl-context.ini in any text editor.
   Find these lines:
   
   jetty.sslContext.keyStorePassword=OBF:...
   jetty.sslContext.keyManagerPassword=OBF:...
   jetty.sslContext.trustStorePassword=OBF:..
   
   They contain the keystore password. The password is stored in encoded (obfuscated) form: OBF:1kfx1k8c1ym91wn11y0q1vno1vne1y101wn51ym51k5u1kch.
   You need to replace the existing passwords with the one you set when creating the keystore, after encoding it the same way.

 

9. To do this, open 4_make_password.bat in any text editor and replace the password "netmonitor" with the password you used when creating the keystore. Also update the Jetty version in the file name jetty-util-12.1.7.jar to the current one (check the actual file name in that folder). Save and run 4_make_password.bat. Enter the user name and the password you set. If the command succeeds, you will see output similar to this in the console:
   
   

   

   
   
   
10. Select the line that starts with OBF, as shown below, and press Enter to copy the password to the clipboard.
    
    

    

    Paste the password in place of the quoted text in the listed lines and save ssl-context.ini.

     

11. Run 5_config_and_restart.bat — it restarts the Jetty service.



 

12. Start a browser and enter: https://localhost:8443/netmonitor/?locale=en.

You are now using the program web interface over a secure connection, as indicated by the icon in the address bar.

More information about configuring HTTPS in Jetty: https://jetty.org/#Loading_Keys_and_Certificates

The program runs on Windows XP/Vista/7/8.1/10/11 and Server 2003/2008/2012/2016/2019/2022. You can download and try the 30-day trial version for free.