Domain and certificate

Access to an instance runs through a reverse proxy that is part of the delivery. It distributes the requests to the components of the application and takes care of the certificate. Which certificate variant applies is chosen in the configuration.

DNS

The instance needs a DNS name pointing at the server. Which records exactly have to be set is stated in the operations manual. For automatic certificate issuance the server has to be reachable from the internet over the usual web ports.

Variant 1: Public certificate

The normal case for a server with a public address. The reverse proxy obtains and renews the certificate on its own through Let’s Encrypt. The prerequisite is publicly resolving DNS. In a sealed-off network this variant does not work.

Variant 2: Internal CA on the LAN

For servers without public reachability. The reverse proxy issues the certificates from its own local certificate authority. For this the devices need an internal DNS record, and the root certificate authority has to be trusted on every device. Otherwise a certificate warning appears.

Switching to a public certificate later is easy: hostname, links and redirect URIs stay the same.

An internal CA is not enough for the Outlook add-in

The web view in Office does not show a certificate warning that could be dismissed. Without the root CA installed on the device, the add-in window simply stays empty, without an error message. For a broad rollout of the add-in you need a publicly trusted certificate, so variant 1 or variant 3.

Variant 3: Behind an existing WAF

If an upstream appliance such as Sophos, F5, HAProxy or nginx already terminates HTTPS, the supplied proxy should not obtain a second certificate. In this variant it only handles the distribution, while termination stays with the appliance.

For the mapping to work, the appliance has to pass through the host header. In the application configuration the public address is stored the way your users call it up. Otherwise invitation links, for instance, lead nowhere.

WAF and streaming

Many appliances buffer the response stream in order to inspect the answer. The chat, however, sends its answers piece by piece. If buffering is active, the answer appears only at the end in one go, or breaks off with long answers. Set an exception in the WAF for the affected paths so the response stream is not buffered, and switch off compression there.

Configuration in the operations manual

Which settings each variant requires is described in the operations manual that comes with the delivery package. Customers receive it together with their access.

Next

UpdatingWhy a release is a tested combination and what the way back looks like.

TroubleshootingWhere to look first when something goes wrong in operation.