HTTPS for Ledger Doctor

About 55 seconds, narrated, with captions. Sample company, made-up data.

With HTTPS on, everything between people's browsers and Ledger Doctor is encrypted. Ledger Doctor keeps the same port: the old http:// address sends people to https://, so bookmarks keep working. Turning HTTPS on, or changing its certificate, takes effect at once; the service doesn't restart.

Setup offers it on the Options step, and admins can turn it on or change it any time in Settings > HTTPS certificate.

Three ways to get a certificate

Make one for this server (the quickest start). Ledger Doctor creates its own certificate authority for your server and uses it to issue a certificate for the server's names. It renews that certificate by itself 30 days before it expires. Each computer trusts the authority once (see below), and renewals need nothing more.
Upload a .pfx: one you bought, or one your IT department issued from its own certificate authority. Its password is used once to open the file and isn't saved.
Pick one from the server's certificate store (Local Computer, Personal). If a certificate can't be used, Ledger Doctor says why next to it.

Before switching, Ledger Doctor checks that the certificate covers the server's name, hasn't expired, is meant for servers ("Server Authentication") and includes its private key. After switching, it connects to itself over HTTPS; if that fails, the previous setting comes back.

Trust the certificate Ledger Doctor makes

Browsers warn about a certificate they don't know. To trust Ledger Doctor's certificate authority on a computer:

Open http://SERVER:47474/ledger-doctor-ca.cer (your server's name and port) and save the file. This address works over plain HTTP on purpose, because a computer needs the file before it trusts HTTPS.
Double-click the file, choose Install Certificate, choose Local Machine, then Place all certificates in the following store and pick Trusted Root Certification Authorities.
Close and reopen the browser.

For many computers, IT can send the same file out with group policy: in Group Policy Management, edit a policy linked to the computers, go to Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Trusted Root Certification Authorities, and import ledger-doctor-ca.cer. The file is also on the server in C:\ProgramData\Ledger Doctor\Https.

The authority only signs certificates for your Ledger Doctor server. Its private key stays on the server, in a folder only administrators, the system and Ledger Doctor's service can open.

Tools that want the certificate as PEM text, like curl, can use http://SERVER:47474/ledger-doctor-ca.pem. Windows curl also needs --ssl-no-revoke with it, because a certificate made for one server has no revocation list to check.

When a certificate is about to expire

A certificate Ledger Doctor made renews itself. For any other certificate, the dashboard shows a notice and Ledger Doctor emails its admins 30 days before it expires. Replace it in Settings before then. For a certificate from the server's store, you can let Ledger Doctor switch by itself to a renewed certificate with the same name once IT adds it to the store.

For IT: the command line

On the server, as an administrator, in the C:\Program Files\Ledger Doctor folder:

LedgerDoctor.Service.exe https status
LedgerDoctor.Service.exe https make [other names]: a certificate from Ledger Doctor's authority, for the server's names plus any you add (a DNS alias, say)
LedgerDoctor.Service.exe https use THUMBPRINT: a certificate from the store. This also lets the service read its private key, which Settings can't do by itself.
LedgerDoctor.Service.exe https pfx C:\path\server.pfx: asks for the password (or reads LD_PFX_PASSWORD)
LedgerDoctor.Service.exe https off

The running service picks up each change within a few seconds.

On the server itself

http://localhost:47474 keeps working on the server, so setup can check the service and anyone at the server's console can still get in if a certificate problem stops HTTPS. If a saved certificate can't be loaded, Ledger Doctor answers over HTTP everywhere and shows a notice until an admin replaces it.