Skip to main content
Version: Developer

Replace self-signed certificates in Kasm Workspaces

Overview​

During installation, the system creates self-signed certificates used when connecting to the web UI. Administrators replace these with valid, trusted certificates for the domain Kasm is published on. An alternative is to place Kasm Server behind a self-managed reverse proxy such as NGINX or Caddy. For that configuration, see the reverse proxy documentation. This guide replaces the self-signed certificates with trusted certificates.

Prerequisites​

  • A working Kasm Workspaces deployment with sudo access on each Web App role server.
  • A trusted certificate and key in PEM format. Acquiring certificates is outside the scope of this guide.
note

For multi-server installations, repeat these steps on each Web App role.

Replace the certificates​

  1. Stop the Kasm services:

    sudo systemctl stop kasm

  2. Replace the kasm_nginx.crt and kasm_nginx.key files:

    sudo cp <your_cert> /opt/kasm/current/certs/kasm_nginx.crt
    sudo cp <your_key> /opt/kasm/current/certs/kasm_nginx.key

  3. Start the Kasm services:

    sudo systemctl start kasm

  4. After 30 seconds, confirm that NGINX is running correctly:

    sudo docker ps | grep kasm_proxy

  5. Confirm that the container has been running for more than 30 seconds.

Video tutorial​

This video walks through installing an SSL certificate on a Kasm Workspaces instance using Let's Encrypt.