In order to use SSL with ntopng (i.e. HTTPS) you need a certificate; you can create your own self signed certificate (1) or obtain it by a Certification Authorities (CA) (2):
- obtain the .pem files
- concatenate the privateKeyFile(.pem) and the certificate/certificateChainFile(.pem)
- Rename it in ntiong-cert.pem and put inside ntopng/httpdocs/ssl/.

The HTTPS server will start on port 3001

Below you can find instructions on how to run ntopng with either a self signed or a CA certificate generated by Let's Encrypt (https://letsencrypt.org)

==== SELFSIGNED CERTIFICATE ====

1	To create the self-signed certificate you need to:

1.1	Install OpenSSL

	On Debian/Ubuntu: sudo apt-get install openssl
	OnRedHat/CentOS: sudo yum install openssl

  	On OSX do: brew install openssl

1.2 Create your SSL certificate

		inside the ntopng folder execute the command: make cert
		and follow the instruction

1.3	OPTIONAL
   	Depending on the distribution and packager you might need
   	this optional step. 

		Copy in the directory where ntopng is running
		the shared libraries needed to enable SSL.

		- Linux
		ln -s /usr/lib/x86_64-linux-gnu/libssl.so .
		Note that this symbolic link is NOT necessary on all linux
		distros. Example it is not required on Fedora Linux.
		Please check this according to your distribution.

		- OSX
		ln -s /usr/local/Cellar/openssl/1.0.1i/lib/libcrypto.dylib .
		ln -s /usr/local/Cellar/openssl/1.0.1i/lib/libssl.dylib .
   
1.4	Edit ntop.conf to enable https
		Edit the /etc/ntopng/ntopng.conf file to include the text --https-port=3001
		You may choose ports other than 3001 but it must be a different port to the http port which is port 3000 by default
		Alternatively you can disable insecure http altogether by replacing the line -w=3000 with --http-port=0
		(-w and --http-port are interchangeable)
   

1.5	Start ntopng

1.6 OPTIONAL
  	"make cert" will create the certificate but you can see below the
  	exact steps if you want to generate the certificate manually.
  
		You now need to locate your ntopng `share` directory. It is usually located at `/usr/share/ntopng` or at `/usr/local/share/ntopng`.
		The next instructions assume it's located at `/usr/local/share/ntopng`.

		== Ubuntu and Centos packages ==

		cd /tmp/
		openssl req -new -x509 -sha256 -extensions v3_ca -nodes -days 365 -out cert.pem
		cat privkey.pem cert.pem > /usr/local/share/ntopng/httpdocs/ssl/ntopng-cert.pem
		/bin/rm -f privkey.pem cert.pem
		cd /usr/local/bin/
		ln -s /usr/lib/x86_64-linux-gnu/libssl.so .
		ntopng

		== HomeBrew Formula ==

		cd /tmp/
		openssl req -new -x509 -sha256 -extensions v3_ca -nodes -days 365 -out cert.pem
		mkdir /usr/local/share/ntopng/httpdocs/ssl/
		cat privkey.pem cert.pem > /usr/local/share/ntopng/httpdocs/ssl/ntopng-cert.pem
		/bin/rm -f privkey.pem cert.pem
		cd /usr/local/bin/
		ln -s /opt/local/lib/libssl.dylib /opt/local/lib/libcrypto.dylib .
		ntopng



==== CA CERTIFICATE [ Let's Encrypt ] ====

Please read https://www.ntop.org/ntopng/securing-ntopng-with-ssl-and-lets-encrypt/ for
a complete tutorial on using Let's Encrypt to secure ntopng.
