Local HTTPS

Some features only work over HTTPS: secure cookies, payment providers' test modes, service workers, and some OAuth sign-ins. Coduva turns on HTTPS for each project with a single click and makes sure the browser trusts these certificates.

How it works

1. Coduva creates a certificate authority (CA) specific to your computer. This CA exists only on your computer.
2. For each project where you turn on HTTPS, a certificate signed by the CA is created (for name.test, valid for 825 days). When a certificate is less than 30 days from expiring, Coduva renews it automatically when it writes the web server configuration.
3. When you add the CA to Windows' trusted certificates, browsers accept these certificates.

The CA is added to the Windows user certificate store (certutil -user). That is why no administrator permission is needed, and only your Windows account is affected.

1. Turn on HTTPS for a project

Use one of three ways:

• When creating a new project: check the Use HTTPS box.
• For an existing project: open the General tab on the project screen and turn on the Use HTTPS toggle.
• In bulk: on the Local HTTPS screen, turn on the toggle on the project's row in the Projects list. The number of projects with HTTPS on is shown at the top of the list (e.g. 2/5 HTTPS).

If the CA does not exist yet, Coduva creates it the first time HTTPS is turned on. It then creates the project certificate and reloads Nginx without interruption. The project's address becomes https://name.test/.

When you turn HTTPS off, the project's certificate is deleted; when you turn it on again, a new one is created.

2. Trust the certificate authority

You only need to do this once.

1. Open the Local HTTPS screen.
2. On the Coduva local certificate authority card, the status shows Not trusted: browsers show a warning. If the CA has not been created yet, the card says "Not created yet"; the button below creates the CA first.
3. Click Trust.
4. Windows shows a security warning window and asks whether you want to install the certificate. Click Yes.

The status changes to Trusted by Windows, and the Remove from trusted button replaces the Trust button. The card also shows the CA's Thumbprint (SHA-1); you can copy it with the copy button next to it and compare it with the thumbprint in Windows' warning window.

Refresh any open browser tabs. If the warning persists, close the browser and open it again.

Edge and Chrome

Microsoft Edge and Google Chrome use the Windows certificate store; no other setting is needed.

Firefox

Firefox can use its own certificate store. If you see warnings on Coduva certificates, make Firefox read the trusted certificates in Windows:

1. Type about:config in Firefox's address bar and accept the warning.
2. Search for security.enterprise_roots.enabled.
3. Set its value to true.
4. Restart Firefox.

HTTPS port

HTTPS uses port 443. If another program is using this port, the Control center shows a warning: "HTTPS port 443 is also in use. Enabling local HTTPS will conflict." The Diagnostics screen also reports the same situation as an error if a project uses HTTPS.

In version 0.2.0, the HTTPS port does not appear on the Settings screen; only the Nginx HTTP port and the MariaDB port can be changed. You need to stop the program that is holding port 443 (usually IIS or another local server).

See the Ports page.

Removing trust

If you no longer use the CA, you can remove it from the trusted certificates:

1. Open the Local HTTPS screen.
2. Click Remove from trusted on the certificate authority card. This button is only visible while the CA is trusted.

After that, browsers show warnings again on Coduva certificates. Your projects keep working, but projects with HTTPS on appear as "not secure".

Protect the CA key

The CA's private key is in the C:\Coduva\etc\ssl\ca folder. Anyone who has this key can create a certificate for any domain that this computer trusts. Do not share this folder with anyone, and leave it out when you upload your backups to the cloud. When you are not using HTTPS, remove the CA from the trusted certificates.

Troubleshooting

Symptom	Cause and solution
The browser says "Your connection is not private"	The CA is not trusted. Local HTTPS → Trust
Only Firefox shows a warning	Set security.enterprise_roots.enabled = true
Nginx does not start, and the log shows SSL_CTX_use_PrivateKey	The project certificate is corrupted. Turn HTTPS off and on again for the project; Coduva regenerates the certificate
The https:// address does not open at all	The HTTPS port may be in use. Diagnostics → Run checks