The certification authority https://letsencrypt.org/ offers free HTTPS certificates, which can even be installed automatically on web servers.

For customers with their own server we offer installation of this certificate free of charge; our virtual machine (VM - Virtual Machine) with Tritius is prepared for it. Let's Encrypt issues certificates only with a limited validity of 90 days. Our system can, however, renew them automatically, so you do not have to worry about anything.

For the installation, however, several conditions must be met:

1. A second- or third-level domain must be routed to our VM. E.g. tritius.knihovna-horni-dolni.cz
2. Ports 80 and 443 must be routed to our VM.
   1. On port 443 the catalogue and Tritius will run under the encrypted HTTPS protocol.
   2. Our VM automatically redirects traffic from port 80 to 443.
   3. Port 80 must be enabled for the authentication of requests to generate certificates by the Let's Encrypt certification authority.

Frequently asked questions (FAQ)

Can traffic on port 80 be restricted to listed IP addresses / networks only (firewall)?

Unfortunately this is not possible. During certificate validation, the Let's Encrypt servers must contact the server being validated, i.e. the VM with Tritius. The IP addresses of the Let's Encrypt servers, however, use a commercial CDN, where the IP addresses are not known and also change over time.