Skip to main content

Configure HTTPS

Secure NIM traffic

Choose a certificate method that fits your environment: self-signed for evaluation, an organization-provided certificate for managed PKI, or Let’s Encrypt for a public hostname that can complete automatic validation and renewal.

Choose a certificate method​

Self-signedFastest for local testing. Browsers show a certificate warning unless the certificate is trusted.
Organization-providedUse an existing server or wildcard certificate that your organization manages.
Let’s EncryptFree, publicly trusted certificates with automatic renewal through the HTTP-01 challenge.

Use a self-signed certificate​

Use this option for evaluation or internal scenarios where clients explicitly trust the certificate.

  1. Go to Configuration → Settings → HTTP(S).
  2. Enable HTTPS.
  3. Under Certificate, select Self signed.
  4. Select Save.

You can then access NIM at https://localhost/.

Use an organization-provided certificate​

Use this method when your organization issues certificates for individual servers or maintains a wildcard certificate.

  1. Add the certificate to NIM.
  2. Go to Configuration → Settings → HTTP(S).
  3. Enable HTTPS.
  4. Under Certificate, select Select from store, then choose the certificate.
  5. Select Save.

Access NIM at https://<hostname>.<domain>/.

Use Let’s Encrypt​

Let’s Encrypt uses the HTTP-01 challenge to prove that NIM controls the requested hostname. During issuance and each renewal, the Let’s Encrypt validation service requests a temporary token at:

http://your-public-hostname/.well-known/acme-challenge/<token>

NIM must be able to answer that request from the public internet. The certificate is issued only after the validation service receives the expected response.

HTTP-01 readiness checklist​

Public DNS name

The External Host URL must use the exact public hostname for the certificate. It cannot be an IP address or an internal-only DNS name.

Correct DNS resolution

Public DNS A and, if present, AAAA records must resolve to the public endpoint that serves the challenge. An incorrect IPv6 record can cause validation to fail even when IPv4 works.

Port 80 reachable

Allow inbound TCP port 80 from the internet and route it to the HTTP endpoint that handles the NIM challenge. Keep it reachable for every future renewal.

Challenge path is preserved

A firewall, load balancer, proxy, or redirect must pass /.well-known/acme-challenge/ to the challenge handler without authentication, rewriting, or blocking it.

Outbound ACME access

The NIM Service needs outbound HTTPS access to Let’s Encrypt to request and renew certificates. Permit the required outbound traffic through any proxy or firewall.

CAA allows Let’s Encrypt

If your DNS zone uses CAA records, allow letsencrypt.org to issue certificates for the hostname.

warning

HTTP-01 validates only through public HTTP on port 80. Opening port 443 is necessary to serve NIM securely after issuance, but it does not replace the port 80 validation path.

Configure NIM-managed Let’s Encrypt​

After every readiness item is complete:

  1. Go to Configuration → Settings → HTTP(S).
  2. Enable the Let’s Encrypt toggle.
  3. Enable Let’s Encrypt challenges only when NIM should reserve its HTTP listener for challenge responses while HTTPS serves the application.
  4. Enter a monitored contact email address and accept the Let’s Encrypt terms of use.
  5. Select Save and allow NIM to request the certificate.

When validation succeeds, access NIM at https://<hostname>.<domain>/. Leave the external hostname, public DNS record, and port 80 routing in place so NIM can renew the certificate automatically.

Use Let’s Encrypt without publishing NIM apps​

An organization can use a publicly trusted Let’s Encrypt certificate without making NIM apps available on the internet. Publish only the HTTP-01 challenge route through a NAT or WAF, and forward it to the NIM Service:

Internet → public hostname:80 → NAT or WAF → NIM Service
                         └─ allow only /.well-known/acme-challenge/*

The NAT or WAF must pass requests for /.well-known/acme-challenge/ to NIM unchanged and must not require authentication, apply a block page, or rewrite the path. Deny all other public routes, including NIM Studio, administrative APIs, and hosted apps. Keep this limited port 80 route available after issuance so automatic renewal can continue.

tip

This approach validates the certificate only. It does not make NIM Studio or an app externally reachable. Users can continue to access NIM over the internal network or VPN.

Using a reverse proxy or NGINX​

If NGINX is the public endpoint, it normally terminates HTTPS and owns ports 80 and 443. In that architecture, do not rely on NIM’s built-in HTTP-01 handler unless the proxy explicitly forwards the challenge path to NIM. Instead, use an ACME client such as win-acme on the NGINX server and configure its webroot challenge location there.

For a secure NGINX configuration that exposes approved apps while keeping NIM Studio and administrative APIs internal, see Allow External Access.

Verify and troubleshoot​

Before requesting the certificate, test the public route from a network outside your organization:

http://your-public-hostname/.well-known/acme-challenge/test

The request does not need to return a valid token before NIM starts a challenge, but it must reach the endpoint that will handle that path—not an authentication page, unrelated application, or proxy error.

SymptomWhat to check
Validation times outConfirm public DNS, inbound port 80, NAT/firewall rules, and any AAAA record.
Validation returns 404 or another appConfirm the challenge path reaches NIM, or the reverse proxy’s ACME webroot when NGINX owns the certificate.
Validation is blocked or redirectedExempt the challenge path from WAF rules, sign-in pages, and path rewriting.
Renewal later failsConfirm the External Host URL, DNS record, and port 80 routing still match the certificate hostname.
CAA errorAdd or correct the CAA authorization for letsencrypt.org.