I want to run my own public nxt / ardor node, but I also want https (letsencrypt). I have a ubuntu server with apache 2.4 installed already. What are the steps to get this setup?

1 Answer 1


As stated here: https://nxtforum.org/public-nodes-vpss/method-to-configure-https-for-nxt-public-nodes/


1) A Linux server running Nxt, and configured for public API access. This should only require creating a nxt.properties under nxt/conf similar to this:

nxt.allowedUserHosts=; localhost; SERVER_IP_ADDRESS; 0:0:0:0:0:0:0:1;

2) A subdomain (or domain) to access your node. This is required to use an SSL certificate. The subdomain should be included in the domain nameservers configuration as an A record pointing to your server IP.


In this example, setup was done using root account. If you're using a non-root account, it needs to be in the sudo group and commands need to be run using sudo.

1) *Turn off Apache if you have it installed already first* Install letsencrypt (certbot) and generate the SSL certificate for your (sub)domain.

wget https://dl.eff.org/certbot-auto
chmod a+x ./certbot-auto
./certbot-auto certonly --standalone --email [email protected] -d sub.example.com

2) Install apache webserver if you dont have it already and enable the modules for ssl and reverse proxy. If you have it installed, just enable proxy_http

apt-get install apache2
a2enmod ssl proxy_http

3) Configure the default apache configuration file.

nano /etc/apache2/sites-available/000-default.conf

Replace the default configuration lines with the following, replacing the strings in red with your (sub)domain. Just comment out the existing one and copy the entire thing below and adjust to your site/directories:

<VirtualHost *:80>
        ServerName sub.example.com
        Redirect permanent / https://sub.example.com/
<IfModule mod_ssl.c>
<VirtualHost *:443>
        ServerName sub.example.com
        SSLEngine on
        SSLCertificateFile /etc/letsencrypt/live/sub.example.com/cert.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/sub.example.com/privkey.pem
        SSLCertificateChainFile /etc/letsencrypt/live/sub.example.com/chain.pem
        SSLProxyEngine On
        ProxyPreserveHost On
        ProxyRequests Off
        ProxyPass / http://localhost:7876/
        ProxyPassReverse / http://localhost:7876/

4) Finally, restart the apache webserver.

service apache2 restart

If you run into 404 errors during install, you'll have to remove those packages like this: https://askubuntu.com/questions/896603/trying-to-install-letsencrypt-on-ubuntu-12-04-using-certbot-auto-program-but-ge/896614#896614

Remember to change your port if your going to use testnet 6876 or mainnet 7876.

Also be sure to open up your ports 7874 for peer connetions.

Ardor ports are testnet 26876 and live 27876

The above also works when making a public Ardor node.

Below is the output after a successful certbot-auto download:


root@localh:~# ./certbot-auto certonly --standalone --email [email protected] -d ardor.xxxxx.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for ardor.xxxx.com
Waiting for verification...
Cleaning up challenges

 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/ardor.xxxx.com/fullchain.pem. Your
   cert will expire on 2017-09-20. To obtain a new or tweaked version
   of this certificate in the future, simply run certbot-auto again.
   To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le
  • Tried this again with Ardor 2.0.3e and ran into some issues on my ubuntu server. I had apache installed and running already. When running certbot-auto it would error out at ERROR BINDING TO PORT 443 . Reason is because apache was still on. Make sure you turn it off first. Overall this is a very easy setup, max 10 minutes if everything goes smoothly. Commented Jun 22, 2017 at 2:55
  • To renew your SSL cert just find the letscrypt command and just do a ./letsencrypt renew -- See: pastebin.com/jAUJZLwT Commented Jun 24, 2017 at 21:26
  • Ran into another issue with a keystore issue. Check your nxt.properties and delete your keystore line. Commented Aug 9, 2017 at 16:45
  • updated again smoothly: prntscr.com/gl57qv Commented Sep 14, 2017 at 16:05
  • For this to work for me with an Ardor node (without typing in the port manually each visit) I had to set ProxyPass / http://localhost:27876/ ProxyPassReverse / http://localhost:27876/ to ProxyPass / https://localhost:27876/ ProxyPassReverse / https://localhost:27876/ notice https instead of http. But other than that, great answer!
    – Will Tate
    Commented Aug 18, 2018 at 23:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.