Configure HTTPS Between Client and Apisix

Configure HTTPS Between Client and Apisix

Create SSL Certificate

Before configuring HTTPS on Apisix, first create an SSL certificate using certbot using the command below with example dosys.tech as a domain.

$ certbot certonly -d dosys.tech

Select the standalone option in the following authentication.

Then we get a certificate file which is found in the /etc/letsencrypt/live/dosys.tech/ folder.

$ ls -lah
total 12K
drwxr-xr-x 2 root root 4.0K Feb 23 16:49 .
drwx------ 3 root root 4.0K Feb 23 16:49 ..
-rw-r--r-- 1 root root 692 Feb 23 16:49 README
lrwxrwxrwx 1 root root 46 Feb 23 16:49 cert.pem -> ../../archive/dosys.tech/cert1.pem
lrwxrwxrwx 1 root root 47 Feb 23 16:49 chain.pem -> ../../archive/dosys.tech/chain1.pem
lrwxrwxrwx 1 root root 51 Feb 23 16:49 fullchain.pem -> ../../archive/dosys.tech/fullchain1.pem
lrwxrwxrwx 1 root root 49 Feb 23 16:49 privkey.pem -> ../../archive/dosys.tech/privkey1.pem

Configure Apisix SSL Certificate

First, make sure a Route has been created with the Host as the domain to which we will add the SSL certificate. For example, the following route has been created with Host dosys.tech where an SSL certificate has previously been created.

Also make sure to activate the redirect route to HTTPS.

Next, we can process the addition of the SSL certificate using cert.pem and privkey.pem, first removing the contents of these two files.

$ cat cert.pem
-----BEGIN CERTIFICATE-----
MIIE/jCCA+agAwIBAgISBMD4LlF822F99nq6kIbMS2evMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yNDAyMjYwMTUzMzZaFw0yNDA1MjYwMTUzMzVaMCMxITAfBgNVBAMT
GGFwaXNpeC5yZWdpYXByaWFuZGkudGVjaDCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBAMrr1SpC5ELLzbyiBrH9YEMIUoTdZ6bmDeKJJvPjz153f2ndyFl+
Dq94EnoamXRqlY/qcf8qSLyKM7qXndUXozz5enoC8BxCftlBuhAZVPj9EdH+KKyk
l8X29EmXCzKJJKyHzlrAT4I813cobLwW1w5AVARbW6UNmRVTHiUwnnG2fXjHZnF4
D5EeVKPkKOnppYreecNJ+uKiMuk8SMJiPv9PXeekWWYbaPK8i0UzgHOlV38Ns8Y2
/n4OftXl7W1XJF7pR1DK42VQhiMP0KY19dNLFkVoT3i9c2Q4Wld2epdlnxuFq985
YHy/0VyxxYecosp10fTJLQJQ1nfNERPOrBcCAwEAAaOCAhswggIXMA4GA1UdDwEB
/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/
BAIwADAdBgNVHQ4EFgQUuNi/I2VDBqy/cpp3Nc0T4V6oGvwwHwYDVR0jBBgwFoAU
FC6zF7dYVsuuUAlA5h+vnYsUwsYwVQYIKwYBBQUHAQEESTBHMCEGCCsGAQUFBzAB
hhVodHRwOi8vcjMuby5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6Ly9yMy5p
LmxlbmNyLm9yZy8wIwYDVR0RBBwwGoIYYXBpc2l4LnJlZ2lhcHJpYW5kaS50ZWNo
MBMGA1UdIAQMMAowCAYGZ4EMAQIBMIIBBQYKKwYBBAHWeQIEAgSB9gSB8wDxAHcA
O1N3dT4tuYBOizBbBv5AO2fYT8P0x70ADS1yb+H61BcAAAGN41UGxQAABAMASDBG
AiEAjSUzxgkipds+vrWGbtYPmc4K0D1B1LCq2gRq1Uu7JdYCIQC8jir3vXWDTBpw
h699O33ro+Z9T0OishV8tg4NPYrMAAB2AEiw42vapkc0D+VqAvqdMOscUgHLVt0s
gdm7v6s52IRzAAABjeNVBsgAAAQDAEcwRQIhAMIStVuYna89wpxusHkMrHKBspB/
qWdKixA2I9yzpPAwAiBozV4966atzsbSzZ627rXojBvqKFOV10mIGZm+OgRExjAN
BgkqhkiG9w0BAQsFAAOCAQEAa1xmU4qGy1nO0dWGpqxJdPO0GoKqyzVE08IgHl7R
o3+HhLGhLIzpvZ/mEe061dlg6/dFAS/cZzvjNVkHMj/bglisrfMOhe3N75kob5Gw
yZXFMekttXOThtxZ0ommqSoUqZhcfCbsCHK1sGlcVPTvS4wSnYjkAFQnXvO3GWKz
QdowGi0DL7meoMp9ZDgFLw530PKzBD3mmcxMqL3dP1AZWkSB3sZIQoDdZ/pNDNoN
H93iopOggsCLzcXQHqa/YeUGHn8qIuSBc3sCBF6wPeWs9uZB4zj1Vf/YXhOjJr9V
aD7yKmOojUb8WDunwObLNtUclbCA2I5pK/ca84nk9MolyA==
-----END CERTIFICATE-----

$ cat privkey.pem
-----BEGIN PRIVATE KEY-----
MIIEwAIBADANBgkqhkiG9w0BAQEFAASCBKowggSmAgEAAoIBAQDK69UqQuRCy828
ogax/WBDCFKE3Wem5g3iiSbz489ed39p3chZfg6veBJ6Gpl0apWP6nH/Kki8ijO6
l53VF6M8+Xp6AvAcQn7ZQboQGVT4/RHR/iispJfF9vRJlwsyiSSsh85awE+CPNd3
KGy8FtcOQFQEW1ulDZkVUx4lMJ5xtn14x2ZxeA+RHlSj5Cjp6aWK3nnDSfriojLp
PEjCYj7/T13npFlmG2jyvItFM4BzpVd/DbPGNv5+Dn7V5e1tVyRe6UdQyuNlUIYj
D9CmNfXTSxZFaE94vXNkOFpXdnqXZZ8bhavfOWB8v9FcscWHnKLKddH0yS0CUNZ3
zRETzqwXAgMBAAECggEBALctHEgCCjuh7h6RxKl3qCXapWL62k527aHJXThcNR15
kbLnWawvduI+6a7/w/arIEfBwxYr/Wz09K1DoF5z8A9ixYTOkiFwhUFpa6SMuX/q
MuP1IpJ2Ieu6edrUVm9QDaMRFN4nK57NfVM7UqyXkZpzx2QHdDsSg1YUqem4cc8C
6U/VcanKijj8CIXPi0Xa3Vnoccs69Dx1YRenw6FnaAulBF2l3j6NNWA/uc24C7Ls
/Vo/+HG9NtELMzDidZ3tNm9F3+xuG/Jj0/EvUx/mcMhmbdiKhrPknt4T7iG7m7YO
nTwfXeQXqA534WgoUIrM4D0uEWFYpZfV/tPDeKy9U0ECgYEA75IMaBfi73J8Otqj
REh1/3FQbSWSTV3sgoJNzVpo3zY1WU7jtVCxcLmaEANFjFA02I07ocprByxdfW6b
tFoM3BeORKHkGg7i8nKDv/ioKNwxaGx+TvvMTR8GaRPMOB4sF9Hlj3oHPtkKcr6q
xc8KRUF6VcJapve2+pedk2TnGn0CgYEA2NZcjJk6EBOHQ+iDY7l8FO0LslEEosoT
wblRlEG+IvLUOmGqZjyfBaGf0wZyo2V80ZS+kZP8z0YNEizvJkavhWUKAgP3Zscu
BofJocPpDPqZon9Aexye0OQCotR/y2FlwYmu9AzlXYlmKghMDwsT26yTtOdfBPLo
IszksmfO0SMCgYEA09JUee00z/Zv9TG/ze4rttIgBIGF3DZBmhtQY1OfCk1J2k8w
cu6IFV1l5OafpbJ9J0OpCCKLg2ost20G6u38FNYXCoQBxTCIZUnvR9u6A3a9kNDs
1TU5rK7T4jCJDs1OuzjxOmzw3xbUcCQ5pnCrahS87/rKYHsCJIvN3bcHx5kCgYEA
ygmx4i9DMod/mX6kLd8+BiF4rIVg1G2FSxPpN0KqbtXjeSJXKzuA0DZwPKfdWPHP
A1ic1/gTru2OcEj966QhFyG12XroohMkh2EuNlPcagN18zquUgew0uIgsqddC5uM
vHAVW8BIVocXckKY28tujViXqA+NMYdDVGmlDbY7thECgYEAlyIhInuJEwlaUs+B
k2RrNEn35I+vO6INpbwZQ5MMLD9wgUvP2TVdXeyPELBzt786STzFx/NJrlhsKyJW
arK29e//7BY0O5JpG1aU4SeLC7CR4gIO1+V6SDoJkl0EtALqWnbEIPGukhnP2RBQ
GpPZUZyCEvO35ZRMiDSqisctGbg=
-----END PRIVATE KEY-----

Then, we can add the SSL certificate to the SSL configuration in Apisix, by using the following command, enter the domain as the value of "snis", then enter the SSL certificate as the value of "cert", finally enter the private key as the value of "key".

curl -i "http://127.0.0.1:9180/apisix/admin/ssls/1" -H "X-API-KEY: <secret-key>" -X PUT -d '
{
    "snis": ["dosys.tech"],
    "cert": "-----BEGIN CERTIFICATE-----\nMIIE/jCCA+agAwIBAgISBMD4LlF822F99nq6kIbMS2evMA0GCSqGSIb3DQEBCwUA\nMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD\nEwJSMzAeFw0yNDAyMjYwMTUzMzZaFw0yNDA1MjYwMTUzMzVaMCMxITAfBgNVBAMT\nGGFwaXNpeC5yZWdpYXByaWFuZGkudGVjaDCCASIwDQYJKoZIhvcNAQEBBQADggEP\nADCCAQoCggEBAMrr1SpC5ELLzbyiBrH9YEMIUoTdZ6bmDeKJJvPjz153f2ndyFl+\nDq94EnoamXRqlY/qcf8qSLyKM7qXndUXozz5enoC8BxCftlBuhAZVPj9EdH+KKyk\nl8X29EmXCzKJJKyHzlrAT4I813cobLwW1w5AVARbW6UNmRVTHiUwnnG2fXjHZnF4\nD5EeVKPkKOnppYreecNJ+uKiMuk8SMJiPv9PXeekWWYbaPK8i0UzgHOlV38Ns8Y2\n/n4OftXl7W1XJF7pR1DK42VQhiMP0KY19dNLFkVoT3i9c2Q4Wld2epdlnxuFq985\nYHy/0VyxxYecosp10fTJLQJQ1nfNERPOrBcCAwEAAaOCAhswggIXMA4GA1UdDwEB\n/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/\nBAIwADAdBgNVHQ4EFgQUuNi/I2VDBqy/cpp3Nc0T4V6oGvwwHwYDVR0jBBgwFoAU\nFC6zF7dYVsuuUAlA5h+vnYsUwsYwVQYIKwYBBQUHAQEESTBHMCEGCCsGAQUFBzAB\nhhVodHRwOi8vcjMuby5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6Ly9yMy5p\nLmxlbmNyLm9yZy8wIwYDVR0RBBwwGoIYYXBpc2l4LnJlZ2lhcHJpYW5kaS50ZWNo\nMBMGA1UdIAQMMAowCAYGZ4EMAQIBMIIBBQYKKwYBBAHWeQIEAgSB9gSB8wDxAHcA\nO1N3dT4tuYBOizBbBv5AO2fYT8P0x70ADS1yb+H61BcAAAGN41UGxQAABAMASDBG\nAiEAjSUzxgkipds+vrWGbtYPmc4K0D1B1LCq2gRq1Uu7JdYCIQC8jir3vXWDTBpw\nh699O33ro+Z9T0OishV8tg4NPYrMAAB2AEiw42vapkc0D+VqAvqdMOscUgHLVt0s\ngdm7v6s52IRzAAABjeNVBsgAAAQDAEcwRQIhAMIStVuYna89wpxusHkMrHKBspB/\nqWdKixA2I9yzpPAwAiBozV4966atzsbSzZ627rXojBvqKFOV10mIGZm+OgRExjAN\nBgkqhkiG9w0BAQsFAAOCAQEAa1xmU4qGy1nO0dWGpqxJdPO0GoKqyzVE08IgHl7R\no3+HhLGhLIzpvZ/mEe061dlg6/dFAS/cZzvjNVkHMj/bglisrfMOhe3N75kob5Gw\nyZXFMekttXOThtxZ0ommqSoUqZhcfCbsCHK1sGlcVPTvS4wSnYjkAFQnXvO3GWKz\nQdowGi0DL7meoMp9ZDgFLw530PKzBD3mmcxMqL3dP1AZWkSB3sZIQoDdZ/pNDNoN\nH93iopOggsCLzcXQHqa/YeUGHn8qIuSBc3sCBF6wPeWs9uZB4zj1Vf/YXhOjJr9V\naD7yKmOojUb8WDunwObLNtUclbCA2I5pK/ca84nk9MolyA==\n-----END CERTIFICATE-----",
    "key": "-----BEGIN PRIVATE KEY-----\nMIIEwAIBADANBgkqhkiG9w0BAQEFAASCBKowggSmAgEAAoIBAQDK69UqQuRCy828\nogax/WBDCFKE3Wem5g3iiSbz489ed39p3chZfg6veBJ6Gpl0apWP6nH/Kki8ijO6\nl53VF6M8+Xp6AvAcQn7ZQboQGVT4/RHR/iispJfF9vRJlwsyiSSsh85awE+CPNd3\nKGy8FtcOQFQEW1ulDZkVUx4lMJ5xtn14x2ZxeA+RHlSj5Cjp6aWK3nnDSfriojLp\nPEjCYj7/T13npFlmG2jyvItFM4BzpVd/DbPGNv5+Dn7V5e1tVyRe6UdQyuNlUIYj\nD9CmNfXTSxZFaE94vXNkOFpXdnqXZZ8bhavfOWB8v9FcscWHnKLKddH0yS0CUNZ3\nzRETzqwXAgMBAAECggEBALctHEgCCjuh7h6RxKl3qCXapWL62k527aHJXThcNR15\nkbLnWawvduI+6a7/w/arIEfBwxYr/Wz09K1DoF5z8A9ixYTOkiFwhUFpa6SMuX/q\nMuP1IpJ2Ieu6edrUVm9QDaMRFN4nK57NfVM7UqyXkZpzx2QHdDsSg1YUqem4cc8C\n6U/VcanKijj8CIXPi0Xa3Vnoccs69Dx1YRenw6FnaAulBF2l3j6NNWA/uc24C7Ls\n/Vo/+HG9NtELMzDidZ3tNm9F3+xuG/Jj0/EvUx/mcMhmbdiKhrPknt4T7iG7m7YO\nnTwfXeQXqA534WgoUIrM4D0uEWFYpZfV/tPDeKy9U0ECgYEA75IMaBfi73J8Otqj\nREh1/3FQbSWSTV3sgoJNzVpo3zY1WU7jtVCxcLmaEANFjFA02I07ocprByxdfW6b\ntFoM3BeORKHkGg7i8nKDv/ioKNwxaGx+TvvMTR8GaRPMOB4sF9Hlj3oHPtkKcr6q\nxc8KRUF6VcJapve2+pedk2TnGn0CgYEA2NZcjJk6EBOHQ+iDY7l8FO0LslEEosoT\nwblRlEG+IvLUOmGqZjyfBaGf0wZyo2V80ZS+kZP8z0YNEizvJkavhWUKAgP3Zscu\nBofJocPpDPqZon9Aexye0OQCotR/y2FlwYmu9AzlXYlmKghMDwsT26yTtOdfBPLo\nIszksmfO0SMCgYEA09JUee00z/Zv9TG/ze4rttIgBIGF3DZBmhtQY1OfCk1J2k8w\ncu6IFV1l5OafpbJ9J0OpCCKLg2ost20G6u38FNYXCoQBxTCIZUnvR9u6A3a9kNDs\n1TU5rK7T4jCJDs1OuzjxOmzw3xbUcCQ5pnCrahS87/rKYHsCJIvN3bcHx5kCgYEA\nygmx4i9DMod/mX6kLd8+BiF4rIVg1G2FSxPpN0KqbtXjeSJXKzuA0DZwPKfdWPHP\nA1ic1/gTru2OcEj966QhFyG12XroohMkh2EuNlPcagN18zquUgew0uIgsqddC5uM\nvHAVW8BIVocXckKY28tujViXqA+NMYdDVGmlDbY7thECgYEAlyIhInuJEwlaUs+B\nk2RrNEn35I+vO6INpbwZQ5MMLD9wgUvP2TVdXeyPELBzt786STzFx/NJrlhsKyJW\narK29e//7BY0O5JpG1aU4SeLC7CR4gIO1+V6SDoJkl0EtALqWnbEIPGukhnP2RBQ\nGpPZUZyCEvO35ZRMiDSqisctGbg=\n-----END PRIVATE KEY-----"
}
'

Finally, we can check whether the SSL certificate has been successfully applied or not. Access the Route with HTTPS redirect runs on port 9443. Here we can confirm that dosys.tech with port 9443 has had a valid SSL certificate applied.