# HTTPS setup for AWX

**URL:** <https://forum.ansible.com/t/https-setup-for-awx/30872>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [July 25, 2019, 8:50pm UTC](https://forum.ansible.com/t/https-setup-for-awx/30872 "2019-07-25T20:50:32Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Angel\_Rengifo\_Cancin](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@Angel\_Rengifo\_Cancin](https://forum.ansible.com/u/Angel_Rengifo_Cancin)\
**Post date:** [July 25, 2019, 8:50pm UTC](https://forum.ansible.com/t/https-setup-for-awx/30872/1 "2019-07-25T20:50:32Z")

</div>

Hello guys:

I’ve just downloaded the latest AWX version today (6.1.0 if I remember correctly). What’s the official or recommended way to setup HTTPS on AWX?

I’ve tried to change ssl\_certificate variable within inventory file, but without any luck. As per this thread…

[https://github.com/ansible/awx/pull/3604](https://github.com/ansible/awx/pull/3604)

It seems there isn’t yet an “official way” to make this setup. Should I instead edit nginx.conf file directly in awx\_web container?

Hope someone can help me. Thanks in advance

---

<div class="post-metadata">

**Author:** ![shivharsh.nec](https://avatars.discourse-cdn.com/v4/letter/s/f05b48/32.png) [@shivharsh.nec](https://forum.ansible.com/u/shivharsh.nec)\
**Post date:** [July 26, 2019, 6:58am UTC](https://forum.ansible.com/t/https-setup-for-awx/30872/2 "2019-07-26T06:58:34Z")

</div>

Hello Angel,

Unfortunately, the AWX GUI does not come with SSL protection by default. You would need to modify the nginx.conf file for SSL support.  
You may follow below steps to enable HTTPS in AWX:

- Change the value for host\_port parameter from 80 to 443 in awx/installer/inventory file and then execute the install.yml playbook to deploy AWX.

`[root@awx installer]# cat inventory |grep host_port #host_port=80 host_port=443 [root@awx installer]# ansible-playbook install.yml`

- Once AWX is installed and docker containers are up and running, go inside the awx\_web container and create a directory for SSL certificates:  
`[root@awx installer]# docker exec -it awx_web /bin/bash bash-4.2# cd /etc/nginx/ bash-4.2# mkdir certs bash-4.2# cd certs/`

- Generate SSL certificates using openssl command:

`  
bash-4.2# openssl genrsa -out server.key 2048  
Generating RSA private key, 2048 bit long modulus  
…+++  
…+++  
e is 65537 (0x10001)

bash-4.2# openssl rsa -in server.key -out server.key  
writing RSA key

bash-4.2# openssl req -sha256 -new -key server.key -out server.csr -subj ‘/CN=awx’

bash-4.2# openssl x509 -req -sha256 -days 365 -in server.csr -signkey server.key -out server.crt  
Signature ok  
subject=/CN=awx  
Getting Private key

bash-4.2# ls -l  
total 12  
-rw-r–r-- 1 root root 960 Jul 26 06:49 server.crt  
-rw-r–r-- 1 root root 883 Jul 26 06:48 server.csr  
-rw-r–r-- 1 root root 1675 Jul 26 06:48 server.key  
`

- Edit the /etc/nginx/nginx.conf file to add SSL certificates.

`server{ server_name: awx ssl_certificate /etc/nginx/certs/server.crt; ssl_certificate_key /etc/nginx/certs/server.key; ssl on; ssl_protocols TLSv1.1 TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5`

- Exit and restart the awx\_web container.

`[root@awx installer]# docker restart awx_web`

On performing the above steps successfully you should be able to access AWX on HTTPS.

Thanks,  
Shivharsh

---

<div class="post-metadata">

**Author:** ![Jeff\_Byrnes1](https://avatars.discourse-cdn.com/v4/letter/j/f19dbf/32.png) [@Jeff\_Byrnes1](https://forum.ansible.com/u/Jeff_Byrnes1)\
**Post date:** [July 29, 2019, 3:27pm UTC](https://forum.ansible.com/t/https-setup-for-awx/30872/3 "2019-07-29T15:27:02Z")

</div>

No need to enter the containers & modify them; this can all be done by building one’s own container. In the installer/inventory file:

1. Comment out line 9:
2. ` dockerhub_base=ansible `
3. Set ssl\_certificate to the NGINX SSL cert you wish to use
4. Run this:
5. ` cd installer ansible-playbook install.yml `

Ansible will run, building your own custom images with your SSL certificate, and once done, start them up using Docker Compose.

No need to edit an existing cert or anything like that, and if you wish to customize the NGINX config, you can do that, and then re-run the build, and it will be included.

You’ll likely wish to set the docker\_registry\_repository & docker\_registry\_username inventory variables to something that allows you to publish these images for later use in a production environment.

---

<div class="post-metadata">

**Author:** ![Angel\_Rengifo\_Cancin](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@Angel\_Rengifo\_Cancin](https://forum.ansible.com/u/Angel_Rengifo_Cancin)\
**Post date:** [August 8, 2019, 9:20pm UTC](https://forum.ansible.com/t/https-setup-for-awx/30872/4 "2019-08-08T21:20:18Z")

</div>

Sorry for the long delay. Thanks a lot for your answers.

I’ve actually edited my inventory file to:

ssl\_certificate=/path/to/my/cert.pem

After I run the install.yml, it mounts my /path/to/my/cert.pem as a volume to the awx\_web container. Inside such container I’m able to see the correct SSL certificate as /etc/nginx/awxweb.pem. However, /etc/nginx/nginx.conf is not configured with SSL nor it isn’t pointing to my SSL certificate. Sure, I can edit nginx.conf to add ssl support with my cert, but I wonder if this is the “official or supported” way to do it. Maybe I’m missing something on my inventory setup which would allow me to skip such manual configuration of my nginx service.

---

<div class="post-metadata">

**Author:** ![Katsutoshi\_Nakatomi](https://avatars.discourse-cdn.com/v4/letter/k/e79b87/32.png) [@Katsutoshi\_Nakatomi](https://forum.ansible.com/u/Katsutoshi_Nakatomi)\
**Post date:** [August 9, 2019, 2:25am UTC](https://forum.ansible.com/t/https-setup-for-awx/30872/5 "2019-08-09T02:25:18Z")

</div>

hi!

I'm not good at English, so excuse me in simple English.

I did this way.

Fix /root/awx/installer/inventory  
ssl\_certificate = my.crt  
ssl\_certificate\_key = my.key

Fixed some sources for passing keys to containers  
roles/local\_docker/templates/docker-compose.yml.j2  
web:  
image: {{awx\_web\_docker\_actual\_image}}  
container\_name: awx\_web

\<snip\>

```
 volumes:
   \-&quot;\{\{docker\_compose\_dir\}\}/SECRET\_KEY: /etc/tower/SECRET\_KEY&quot;
   \-&quot;\{\{docker\_compose\_dir\}\}/environment\.sh: /etc/tower/conf\.d/environment\.sh&quot;
   \-&quot;\{\{docker\_compose\_dir\}\}/credentials\.py: /etc/tower/conf\.d/credentials\.py&quot;

```

Add this ----\>-"{{docker\_compose\_dir}}/nginx.conf: /etc/nginx/nginx.conf"

\<snip\>

```
 \{% if ssl\_certificate is defined%\}
   \-&quot;\{\{ssl\_certificate \+ &#39;: /etc/nginx/awxweb\.pem: ro&#39;\}\}&quot;

```

Add this ----\>-"{{ssl\_certificate\_key + ': /etc/nginx/awxweb.key: ro'}}"  
{% endif%}

Since there is a bug that does not expand nginx.conf.j2, the attached file is placed in /tmp/awxcompose/nginx.conf

Change secret\_key temporarily  
/root/awx/installer/inventory  
\<snip\>  
secret\_key = awxsecret can be rewritten appropriately to be "" "

Reinstall AWX (remake container)  
ansible-playbook -i inventory install.yml

If it completes successfully, it will be automatically rewritten to https: // when you access http: //my\_host/.

> **(attachments)**
>
> [nginx.conf.txt](https://forum.ansible.com/uploads/short-url/7ck0oToq3KiWUhM2a9v3m5dUAjR.txt) (4.23 KB)

---

<div class="post-metadata">

**Author:** ![Chris\_Herdt](https://avatars.discourse-cdn.com/v4/letter/c/dec6dc/32.png) [@Chris\_Herdt](https://forum.ansible.com/u/Chris_Herdt)\
**Post date:** [August 9, 2019, 2:42am UTC](https://forum.ansible.com/t/https-setup-for-awx/30872/6 "2019-08-09T02:42:32Z")

</div>

To do this, you should build your own images for awx\_task and awx\_web. See [https://github.com/ansible/awx/blob/devel/INSTALL.md#official-vs-building-images](https://github.com/ansible/awx/blob/devel/INSTALL.md#official-vs-building-images)

The actual command to build your own images is:

ansible-playbook -i inventory build.yml

Building your own images will take care of copying the file specified in the ssl\_certificate variable, and configure nginx.

After you run the build playbook, you still need to run the install playbook:

```auto
    ansible-playbook -i inventory install.yml

```

(The above worked for me. I used docker-compose as my deployment platform.)

---

<div class="post-metadata">

**Author:** ![Angel\_Rengifo\_Cancin](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@Angel\_Rengifo\_Cancin](https://forum.ansible.com/u/Angel_Rengifo_Cancin)\
**Post date:** [August 9, 2019, 12:53pm UTC](https://forum.ansible.com/t/https-setup-for-awx/30872/7 "2019-08-09T12:53:23Z")

</div>

Thank you all, I already solved this by following Jeff Byernes’ recommendation. All I needed to do is to change the following in my inventory file:

1. Comment out dockerhub\_base=ansible at line 9
2. Set host\_port\_ssl=443 and ssl\_certificate=/path/to/my/cert.pem

Step 1 was required by install.yml (at line 6) which includes image\_build role only if dockerhub\_base is not defined  
Step 2 is more obvious. The only important thing here is to combine the certificate and private key file in my /path/to/my/cert.pem file. There’s no need to hack any file for including a separate ssh\_certificate\_key directive anywhere

After running the install.yml playbook again (and wait for some minutes) everything worked as expected.

Thanks again everyone