Enable Native SSL/TLS for Pulse Web UI
You can enable SSL/TLS support for the Pulse Web UI without using the AD Proxy (Traefik) container.
This configuration allows users to access the Pulse Web UI directly over HTTPS through the Pulse UI container.
Info
The ad-graphql (OLD Pulse UI) has been deprecated and has been replaced by ad-pulse-ui (NEW Pulse UI) starting from version 4.0.x and above.
SSL Configuration Variables
The Pulse UI SSL/TLS behavior is controlled through environment variables defined in the ad-core.yml configuration file under the ad-pulse-ui service.
Configuration File Location
$AcceloHome/config/docker/ad-core.yml
Configuration Section
ad-pulse-ui:
environment:
- SSL_ENFORCED=false
- SSL_ENABLED=false
- SSL_KEYDIR=/etc/acceldata/ssl/
- SSL_KEYFILE=ssl.key
- SSL_CERTDIR=/etc/acceldata/ssl/
- SSL_CERTFILE=ssl.crt
- SSL_PASSPHRASE=""
Configure these variables to enable HTTPS and specify the SSL certificate and key files used by the Pulse Web UI.
Variable Name | Default Value | Mandatory | Description |
SSL_ENFORCED | false | Yes | Enforces HTTPS for the UI port inside the container. When set to true, the HTTP port is disabled. |
SSL_ENABLED | false | Yes | Enables HTTPS for the UI port inside the container. When SSL_ENFORCED=false, both HTTP and HTTPS can be used. |
SSL_KEYDIR | /etc/acceldata/ssl/ | No | Directory inside the container where the SSL/TLS key file is located. |
SSL_KEYFILE | ssl.key | No | Name of the SSL/TLS key file. |
SSL_CERTDIR | /etc/acceldata/ssl/ | No | Directory inside the container where the SSL/TLS certificate file is located. |
SSL_CERTFILE | ssl.crt | No | Name of the SSL/TLS certificate file. |
SSL_PASSPHRASE | Empty | No | Passphrase for the SSL/TLS key file, if applicable. |
Before You Begin
Obtain the SSL certificate and private key files required for HTTPS access.
Copy the files to:
$AcceloHome/config/proxy/certs
Rename the files exactly as:
ssl.crt
ssl.key
Ensure both files are readable by all Linux users:
chmod 0644 $AcceloHome/config/proxy/certs/ssl.crt
chmod 0644 $AcceloHome/config/proxy/certs/ssl.key
Configure SSL/TLS
Step 1: Verify the Configuration File
ls -lha $AcceloHome/config/docker/ad-core.yml
If the file does not exist, generate it:
accelo admin makeconfig ad-core
Step 2: Configure SSL Environment Variables
Open ad-core.yml and locate the ad-pulse-ui section.
To enable HTTPS only:
- SSL_ENFORCED=true
- SSL_ENABLED=true
With this configuration:
- HTTPS is enabled.
- HTTP access is disabled.
- Users can access the Pulse Web UI only through HTTPS.
To enable both HTTP and HTTPS:
- SSL_ENFORCED=false
- SSL_ENABLED=true
With this configuration:
- HTTPS is enabled.
- HTTP remains enabled.
- Users can access the Pulse Web UI using either HTTP or HTTPS.
Step 3: Mount the Certificate Directory
Add the SSL certificate directory to the volumes section:
volumes:
- /etc/localtime:/etc/localtime:ro
- /etc/hosts:/etc/hosts:ro
- ./work/license:/etc/acceldata/license:ro
- ./config/proxy/certs:/etc/acceldata/ssl
Step 4: Configure Network Ports
Enable both HTTP and HTTPS:
ports:
- 4000:4000
- 4001:4001
- Port 4000 = HTTPS
- Port 4001 = HTTP
Example of exposing HTTPS on a different host port:
ports:
- 80:4000
Step 5: Save the Configuration
Save and close the ad-core.yml file.
Step 6: Restart the Pulse UI Service
accelo restart ad-pulse-ui
Verify the Configuration
Check Container Logs
docker logs -f ad-pulse-ui_default
Verify Port Exposure
docker ps -a | grep ad-pulse-ui_default
Access Pulse Using HTTPS
https://<hostname>:<https-port>
Example:
https://pulse.example.com:4000
Result
If the Pulse UI container starts successfully, no SSL-related errors appear in the logs, and the configured HTTPS port is accessible, SSL/TLS has been successfully enabled for the Pulse Web UI.
For details on updating and using the SSL options, see Update the SSL Options for UI.