Encrypting Communications: Configuring HTTPS in Leapwork

Introduction

To secure communications in Leapwork, it is essential to encrypt data exchanged between the Leapwork Controller, Studio, and Agents. This is done by configuring HTTPS ports. This guide will provide detailed instructions for configuring HTTPS in Leapwork. You will learn how to modify configuration files, generate the necessary certificates, and set up secure communication ports to ensure a secure environment for your Leapwork setup.

Please Note: Configuration steps may differ slightly depending on the version of Leapwork. Please refer to version-specific instructions below.

1. Configure the Controller

For Leapwork versions 2025.1.173 and later:

To enable HTTPS, open the controller.config file located at: C:\Program Files\Leapwork\Controller\controller.config

Add or update the following fields:

Save the file and restart the Leapwork Controller service.

For Leapwork versions 2024.2.32:

In these versions, the EnableHttps field is not included by default and must be manually added. Follow the steps below:

  1. Open controller.config from: C:\Program Files\Leapwork\Controller\controller.config

  2. Manually insert the following entries:

    • "HTTPSControllerPort": 9006,
    • "EnableHttps": true

  3. Save the file and restart the Leapwork Controller service.

2. Configure the Studio:

For Leapwork versions 2025.1.173 and later:

To enable HTTPS in Studio, open the studio.config file found at: %localAppData%\Leapwork\studio.config

Locate the configuration block for the active Controller and update it as follows:

For Leapwork versions 2024.2.32:

The EnableHttps field will not be present by default and must be manually added.

  1. Open studio.config from: %localAppData%\Leapwork\studio.config

  2. Add or modify the controller block with:

    • "Port": 9006,
    • "EnableHttps": true

Note - If you're using Leapwork 2024.2.32, please be aware:

3. Generating and Configuring HTTPS Certificates for Leapwork

(Before you begin, please note, if your organization uses Active Directory Certificate Services, you can directly contact your IT team to get the required HTTPS certificate. AD CS simplifies and secures certificate management according to your organization’s policies.)

To enable HTTPS for Leapwork, you can generate certificates using either OpenSSL (recommended for IP Address) or PowerShell.

3.1. Using OpenSSL:

Step 1: Download and Install OpenSSL

Step 2: Create Configuration File

Create a file named san.cnf and add the following content, modify according to your needs:

[req]
default_bits = 4096
default_md = sha256
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no

[req_distinguished_name]
CN = <Your_Controller_IP>

[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
IP.1 = <Your_Controller_IP>

Step 3: Generate the Certificate

Open command prompt in Admin mode.

Execute the following command to generate the certificate:

openssl req -new -nodes -x509 -days 730 -keyout leapworkhttps_v2.key -out leapworkhttps_v2.crt -config C:\opensslcert\NewCert\san.cnf

Create a .pfx file by executing the following command, provide some password:

openssl pkcs12 -export -out leapworkhttps_v2.pfx -inkey leapworkhttps_v2.key -in .\leapworkhttps_v2.crt

Convert the certificate to .cer format:

openssl x509 -in leapworkhttps_v2.crt -out leapworkhttps_v2.cer -outform PEM

Step 4: Install Certificates

On the controller machine:

  1. Navigate to the location of the .pfx file (Sample Path: C:\path\to\certificate.pfx). Execute the .pfx file.
  2. Click on "Next Button" to import the file.
  3. Enter the same password used while generating the certificate.
  4. Install it under the local computer.

Step 5: Import the Certificate to Java KeyStore:
Navigate to C:\Program Files\Java\jdk-11.0.15\bin in CMD (on the studio machine).

Now execute the following command:

keytool -importcert -alias "leapworkhttpscert_v2" -keystore "C:\Program Files\Java\jdk-17\lib\security\cacerts" -storepass changeit -file "C:\tmp\new\leapworkhttps_v2.cer"

3.2. Using PowerShell:

Step 1: Prepare the Environment

Step 2: Generate the Certificate

On the controller machine, open Windows PowerShell ISE in Admin mode. Run the following commands one by one:

$certificate = New-SelfSignedCertificate -DnsName <Your_IP_Address>-NotBefore (Get-Date) -NotAfter (Get-Date).AddYears(2) -CertStoreLocation "cert:CurrentUser\My" -FriendlyName "Leapwork Certificate for testing"
$tmpPath = "C:\tmp"
$pfxPassword = ConvertTo-SecureString -String password -Force -AsPlainText
$pfxFilePath = "c:\tmp\localhost.pfx"
$cerFilePath = "c:\tmp\localhost.cer"
Export-PfxCertificate -Cert $certificatePath -FilePath $pfxFilePath -Password $pfxPassword
Export-Certificate -Cert $certificatePath -FilePath $cerFilePath
Import-PfxCertificate -FilePath $pfxFilePath Cert:\LocalMachine\My -Password $pfxPassword -Exportable
Import-Certificate -FilePath "c:\tmp\localhost.cer" -CertStoreLocation Cert:\CurrentUser\Root

4. Configure HTTPS Ports:

On the controller machine, open CMD in Admin mode.

Run the following commands:

netsh http add urlacl url=https://+:9006/ user=Everyone
netsh http add sslcert ipport=0.0.0.0:9006 certhash=c7808b833cfcbd95e44fdfabe31ca1f015b6ab09 appid={12e7fbe8-ba1d-40f9-ba4e-fe6c60a7a7e0}

5. Test the connection by opening the following URL in a browser:

https://localhost:9006/signalr/hubs

6. Configure Firewall and HTTPS for Leapwork APIs:

Enable Port Access, please go through how to enable port to accept inbound/outbound traffic HTTPs configuration for Leapwork APIs

7. For Rest API (HTTPS):

Set up REST API for HTTPS, after executing the above steps 1-3 (Configure Controller, Configure Studio and generating certificate)

On the controller machine, run the following commands in CMD (Admin mode):

netsh http add urlacl url=https://+:9002/ user=Everyone
netsh http add sslcert ipport=0.0.0.0:9002 certhash=c7808b833cfcbd95e44fdfabe31ca1f015b6ab09 appid={12e7fbe8-ba1d-40f9-ba4e-fe6c60a7a7e0}

Additional Notes:

  1. New Field in controller.config:
  1. Firewall Rules for Studio Connectivity:

Key Troubleshooting Areas and Steps to Solve:

Handling Certificates and Firewall:

Specifying the Common Name (CN) Correctly:

By following these steps, you can ensure that your Leapwork environment is secured with encrypted communications, providing a safer and more reliable setup.

If you have any questions, contact our Priority Support.