Enterprise

Install certificates

Make a computer trust the self-signed CA certificate of a Synnax Core.

A computer must trust the CA certificate of a Synnax Core that uses a self-signed certificate. Install the CA certificate on each computer that runs the Console, a browser, a standalone Driver, or a TypeScript client in Node.js. A Core with a certificate from a public CA, or from a CA that your computers already trust, needs none of this.

Copy the CA certificate

The CA certificate is ca.crt in the certificate folder of the Core:

Linux and macOS -> /usr/local/synnax/certs/ca.crt
Windows service -> C:\ProgramData\Synnax\certs\ca.crt
Docker -> /usr/local/synnax/certs/ca.crt in the container. Copy it out with docker cp synnax:/usr/local/synnax/certs/ca.crt ./synnax-ca.crt.

If the Core started with --certs-dir, the file is in that folder. Copy only ca.crt. Never copy ca.key to another computer.

Install the certificate

On Debian and Ubuntu:

sudo cp synnax-ca.crt /usr/local/share/ca-certificates/synnax-ca.crt
sudo update-ca-certificates

On RHEL and Fedora:

sudo cp synnax-ca.crt /etc/pki/ca-trust/source/anchors/synnax-ca.crt
sudo update-ca-trust

The Console, Chrome, and a standalone Driver use this store. Firefox on Linux does not: in Firefox, open Settings, search for “certificates”, click View Certificates, and import the file on the Authorities tab.

In PowerShell as an administrator:

Import-Certificate -FilePath synnax-ca.crt `
  -CertStoreLocation Cert:\LocalMachine\Root

The Console, browsers, and a standalone Driver use this store.

sudo security add-trusted-cert -d -r trustRoot \
  -k /Library/Keychains/System.keychain synnax-ca.crt

The Console and browsers use the Keychain. A standalone Driver does not. In the shell that runs synnax-driver, point it at the file:

export GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=/path/to/synnax-ca.crt

GRPC_DEFAULT_SSL_ROOTS_FILE_PATH replaces every certificate the Driver trusts. Set it only for a Core with a self-signed certificate.

Node.js

Node.js does not read the operating system store. Start the TypeScript client with the CA certificate in NODE_EXTRA_CA_CERTS:

NODE_EXTRA_CA_CERTS=/path/to/synnax-ca.crt node app.js

To make the Python client trust the CA certificate, give it the path in ca_cert.

Set up TLS

Serve multiple listeners