Source: https://api.octoperf.com/doc/on-premise-infra/tutorials/https-setup/

# On-Premise Infra with HTTPS

To enable HTTPS encryption on OctoPerf On-Premise Infra, the [HTTPS version](https://api.octoperf.com/doc/on-premise-infra/download/enterprise-edition-ssl.zip) requires some extra configuration to work compared to the regular HTTP plain version.

This tutorial explains how to configure OctoPerf EE to serve the content through HTTPS, also known as [SSL encryption](https://www.cloudflare.com/learning/ssl/what-is-ssl/).

## Pre-requisites

To setup OctoPerf EE with SSL encryption:

- Download [OctoPerf On-Premise Infra HTTPS version](https://api.octoperf.com/doc/on-premise-infra/download/enterprise-edition-ssl.zip). If you don't know how to setup OctoPerf On-Premise Infra, please check our [Installation Guide](https://api.octoperf.com/doc/on-premise-infra/#quick-setup) first,
- Unzip the content on the host where OctoPerf On-Premise Infra is going to run.

The zip is preconfigured with SSL encryption both on Load-Balancer and Backend side. However, some custom configuration is still required.

You will also need:

- A hostname: the hostname must be resolvable from your network by DNS (example: `api.octoperf.com`, which is publicly available),
- `server.crt` and `server.crt.key`: you need an SSL certificate generated by a valid certification authority for the previous hostname.

We're almost done, let's configure both the backend and the load balancer using SSL encryption.

## Backend Configuration

First, let's configure the backend by editing `config/application.yml` file:

```yaml
server:
  scheme: https
  public:
    port: 443
  hostname: YOUR_HOSTNAME
  # it tells the backend to take `X-Forwarded-*` HTTP headers to get information about the client 
  # performing the requests (like his IP and the scheme used between the client and the load-balancer)
  forward-headers-strategy: native
  # regular expression to match the IPs of the load balancer, thus ignoring them when trying to resolve client IP
  # Configured by default internal docker IPs
  tomcat:
    remoteip:
      internal-proxies: "172\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"
```

Replace `YOUR_HOSTNAME` by the hostname for which your SSL certificate has been generated.

## Load Balancer Configuration

Now, let's configure the Traefik load balancer with your own SSL certificate:

- Copy your `server.crt` and `server.crt.key` to the `traefik/certs/` folder. In the case your files have a different name, please rename them to match the expected names.

The load balancer also listens on port `80` and permanently redirects every HTTP request to HTTPS, so users who type `http://YOUR_HOSTNAME` land on the secure address. Make sure port `80` is free on the machine, along with port `443`.

## Start OctoPerf EE

Run the command `make` from the command-line to start the server. The server should start pretty quickly (usually within 30-45sec), but it depends on the hardware used. 

Browser to `https://YOUR_HOSTNAME` (`YOUR_HOSTNAME` must be replaced by the hostname you configured before).