Switching a Windows installation of ONLYOFFICE Workspace Community to HTTPS

Introduction

In most cases, accessing the portal via the HTTPS protocol is much more secure than via HTTP, which is used by default. However, to change the portal access method, certain actions must be performed.

Before you can start to switch your ONLYOFFICE Workspace Community to HTTPS, you will need to create a security certificate in the .pem format.

Once you have the certificate, proceed with the steps below to find out how to switch your ONLYOFFICE Workspace Community to HTTPS.

Switching ONLYOFFICE Workspace Community to HTTPS using the script

The faster way to switch ONLYOFFICE Workspace Community to HTTPS is to use the script. Refer to this article to find out how to do it.

Switching ONLYOFFICE Community Server version 8.5 and later to HTTPS manually

You can perform all the script actions manually. To do that, follow the steps below.

Version 8.5 uses IIS 7, which has its own peculiarities. You will need to bind your security certificate to ONLYOFFICE Community Server using the built-in IIS tools.

If you have a security certificate (either self-signed or issued by a third party), you can bind it to ONLYOFFICE Community Server:

1. Enter the Internet Information Services (IIS) Manager.
2. Select the site you need to bind the certificate to (the ONLYOFFICE portal).
3. Use the Bindings... option of the right-side menu to open the Site Bindings dialog window.
4. In the window that opens, click Add....
5. Change the type to https and select the previously created certificate from the SSL certificate drop-down menu.
6. Click OK and then close the Site Bindings window.

After that, your certificate will be bound to ONLYOFFICE Community Server. If you have more questions about certificates in IIS 7, refer to the appropriate Microsoft knowledge base articles.

Now you need to enable the rewrite rules for your server so that it processes HTTPS requests instead of HTTP ones. To do that:

1. Enter the Internet Information Services (IIS) Manager.
2. Select the site you need to enable HTTPS for.
3. Use the URL Rewrite option of the right-side menu to open the URL Rewrite window.
4. Find the following rules: HTTP to HTTPS and Add Strict-Transport-Security when HTTPS and select Enable Rule for each of them in the right-side panel.

The next steps are not obligatory, but if you want to safeguard your ONLYOFFICE Community Server installation, we strongly recommend that you do it. Go to the IIS Crypto webpage. This is a free tool that gives administrators the ability to enable or disable protocols, ciphers, hashes, and key exchange algorithms on Windows Server 2008, 2012, and 2016. It also lets you reorder SSL/TLS cipher suites offered by IIS, implement best practices with a single click, create custom templates, and test your website. Download and run it, select Best Practices, and then Apply. After that, reboot your server.

Now you can check if everything is done correctly in the following way:

• Open your portal using the https:// prefix. If it opens and works, then everything is done correctly.
• If your ONLYOFFICE Community Server is available via the internet, you can test its security using the SSL Server Test website. Enter your domain name in the Hostname field and click Submit. Wait for the results. Your security rating should be no worse than A.

Switching ONLYOFFICE Community Server version 7.7.1 and later to HTTPS (prior to 8.5)

1. Create the ssl_cert folder in the c:\Program Files\Ascensio System SIA\ONLYOFFICE\Router\ directory.
2. Copy the certificate in .pem format into this newly created directory.
3. Restart the ONLYOFFICE Router service.
   Port 443 must be opened for correct portal operation.
4. Locate and open the Web.config file in the WebStudio folder (you will need administrator access rights to save the changes), and find the following section in it:

   <rewrite>
       <rules>
           ...
       </rules>
   </rewrite>

   Replace everything within this section (marked by "..." above) with the following rules:

   <rule name="HTTP to HTTPS" stopProcessing="true">
       <match url=".*" />
       <conditions>
           <add input="{HTTPS}" pattern="off" />
           <add input="{REQUEST_URI}" pattern="^/api/2.0/" negate="true" />
           <add input="{REQUEST_URI}" pattern="products/files/services/wcfservice/service.svc.*" negate="true" />
       </conditions>
       <action type="Redirect" url="https://{HTTP_HOST}/{R:0}" appendQueryString="true" redirectType="Temporary" />
   </rule>      
   <rule name="WCF files HTTPS to HTTP" stopProcessing="true">
       <match url="products/files/services/wcfservice/service.svc.*" />
       <conditions>
           <add input="{HTTPS}" pattern="on" /> 
       </conditions>
       <action type="Rewrite" url="http://{HTTP_HOST}/{R:0}" appendQueryString="true" />
   </rule>

Switching older versions of ONLYOFFICE Community Server to HTTPS (prior to 7.7.1)

Switching older ONLYOFFICE Community Server versions to HTTPS requires the following steps:

1. Put the certificate in the .pem format with the private key into a folder on the computer with ONLYOFFICE Community Server installed.
2. Go to the c:\Program Files\Ascensio System SIA\ONLYOFFICE\Router\ folder and open the config.js file with a text editor. You need administrator access rights to be able to save the changes.
3. Locate the following line:

   config.sslCertPath = '../Cert/https-cert.pem';

   Replace ../Cert/https-cert.pem with the path where you put the certificate.
   Note that you need to write the absolute path to the certificate file (e.g., C:/Cert/mycertificate.pem), and forward slashes (not backslashes) must be used in the path, just as shown in the example.
4. Restart the ONLYOFFICE Router service.
   The appropriate ports must be opened and node.js must be added to firewall exceptions or allow rules.

You might also need to change sslCertPath to sslCert in the config.sslCertPath parameter line.