## **Introduction**

To secure communications in Leapwork, it is essential to encrypt data exchanged between the Leapwork Controller, Studio, and Agents. This is done by configuring HTTPS ports. This guide will provide detailed instructions for configuring HTTPS in Leapwork. You will learn how to modify configuration files, generate the necessary certificates, and set up secure communication ports to ensure a secure environment for your Leapwork setup.

**Please Note:** Configuration steps may differ slightly depending on the version of Leapwork. Please refer to version-specific instructions below.

### **1. Configure the Controller**

**For Leapwork versions 2025.1.173 and later:**

To enable HTTPS, open the controller.config file located at: C:\Program Files\Leapwork\Controller\controller.config

Add or update the following fields:

- "HTTPSControllerPort": 9006,
- "EnableHttps": true

Save the file and restart the **Leapwork Controller** service.

**For Leapwork versions 2024.2.32:**

In these versions, the EnableHttps field is not included by default and must be manually added. Follow the steps below:

1. Open controller.config from: C:\Program Files\Leapwork\Controller\controller.config
2. Manually insert the following entries:
   
   - "HTTPSControllerPort": 9006,
   - "EnableHttps": true

3. Save the file and restart the **Leapwork Controller** service.

### **2. Configure the Studio:**

**For Leapwork versions 2025.1.173 and later:**

To enable HTTPS in Studio, open the `studio.config` file found at: %localAppData%\Leapwork\studio.config

Locate the configuration block for the active Controller and update it as follows:

- "Port": 9006,
- "EnableHttps": true

**For Leapwork versions 2024.2.32:**

The _`EnableHttps`_ field will not be present by default and must be manually added.

1. Open `studio.config` from: %localAppData%\Leapwork\studio.config
2. Add or modify the controller block with:
  
   - "Port": 9006,
   - "EnableHttps": true

**Note -** If you're using Leapwork 2024.2.32, please be aware:

- _EnableHttps_ is not included automatically in configuration files.
- You must manually add this setting to both controller.config and studio.config.
- Ensure the files are saved correctly and services are restarted for the changes to take effect.

### **3. Generating and Configuring HTTPS Certificates for Leapwork**
(Before you begin, please note, if your organization uses Active Directory Certificate Services, you can directly contact your IT team to get the required HTTPS certificate. AD CS simplifies and secures certificate management according to your organization’s policies.)

To enable HTTPS for Leapwork, you can generate certificates using either OpenSSL (recommended for IP Address) or PowerShell.

#### **3.1. Using OpenSSL:**

**Step 1:** Download and Install OpenSSL

- Download OpenSSL from [Win32/Win64 OpenSSL Installer for Windows - Shining Light Productions](https://slproweb.com/products/Win32OpenSSL.html).

- Install OpenSSL with default settings.
- Add OpenSSL’s bin path to your system environment variables.

**Step 2:** Create Configuration File

Create a file named san.cnf and add the following content, modify according to your needs:

```ini
[req]
default_bits = 4096
default_md = sha256
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no

[req_distinguished_name]
CN = <Your_Controller_IP>

[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
IP.1 = <Your_Controller_IP>
```

**Step 3:** Generate the Certificate

Open command prompt in Admin mode.

Execute the following command to generate the certificate:

```bash
openssl req -new -nodes -x509 -days 730 -keyout leapworkhttps_v2.key -out leapworkhttps_v2.crt -config C:\opensslcert\NewCert\san.cnf
```

Create a .pfx file by executing the following command, provide some password:

```bash
openssl pkcs12 -export -out leapworkhttps_v2.pfx -inkey leapworkhttps_v2.key -in .\leapworkhttps_v2.crt
```

Convert the certificate to .cer format:

```bash
openssl x509 -in leapworkhttps_v2.crt -out leapworkhttps_v2.cer -outform PEM
```

**Step 4: Install Certificates**

On the controller machine:

1. Navigate to the location of the .pfx file (Sample Path: C:\path\to\certificate.pfx). Execute the .pfx file.
2. Click on "Next Button" to import the file.
3. Enter the same password used while generating the certificate.
4. Install it under the local computer.

**Step 5: Import the Certificate to Java KeyStore:**  
Navigate to C:\Program Files\Java\jdk-11.0.15\bin in CMD (on the studio machine).

Now execute the following command:

```bash
keytool -importcert -alias "leapworkhttpscert_v2" -keystore "C:\Program Files\Java\jdk-17\lib\security\cacerts" -storepass changeit -file "C:\tmp\new\leapworkhttps_v2.cer"
```

### **3.2. Using PowerShell:**

**Step 1:** Prepare the Environment

- Create a folder named “tmp” in the C drive.

**Step 2:** Generate the Certificate

On the controller machine, open Windows PowerShell ISE in Admin mode. Run the following commands one by one:

```powershell
$certificate = New-SelfSignedCertificate -DnsName <Your_IP_Address>-NotBefore (Get-Date) -NotAfter (Get-Date).AddYears(2) -CertStoreLocation "cert:CurrentUser\My" -FriendlyName "Leapwork Certificate for testing"
$tmpPath = "C:\tmp"
$pfxPassword = ConvertTo-SecureString -String password -Force -AsPlainText
$pfxFilePath = "c:\tmp\localhost.pfx"
$cerFilePath = "c:\tmp\localhost.cer"
Export-PfxCertificate -Cert $certificatePath -FilePath $pfxFilePath -Password $pfxPassword
Export-Certificate -Cert $certificatePath -FilePath $cerFilePath
Import-PfxCertificate -FilePath $pfxFilePath Cert:\LocalMachine\My -Password $pfxPassword -Exportable
Import-Certificate -FilePath "c:\tmp\localhost.cer" -CertStoreLocation Cert:\CurrentUser\Root
```

### **4. Configure HTTPS Ports:**

On the controller machine, open CMD in Admin mode.

Run the following commands:

```bash
netsh http add urlacl url=https://+:9006/ user=Everyone
netsh http add sslcert ipport=0.0.0.0:9006 certhash=c7808b833cfcbd95e44fdfabe31ca1f015b6ab09 appid={12e7fbe8-ba1d-40f9-ba4e-fe6c60a7a7e0}
```

### **5. Test the connection by opening the following URL in a browser:**

[https://localhost:9006/signalr/hubs](https://localhost:9006/signalr/hubs)

### **6. Configure Firewall and HTTPS for Leapwork APIs:**

Enable Port Access, please go through how to enable port to accept inbound/outbound traffic [HTTPs configuration for Leapwork APIs](/content/product/documentation/rest-api/v4/https-configuration-for-leapwork-apis/index.html)

### **7. For Rest API (HTTPS):**

Set up REST API for HTTPS, after executing the above steps 1-3 (Configure Controller, Configure Studio and generating certificate)

On the controller machine, run the following commands in CMD (Admin mode):

```bash
netsh http add urlacl url=https://+:9002/ user=Everyone
netsh http add sslcert ipport=0.0.0.0:9002 certhash=c7808b833cfcbd95e44fdfabe31ca1f015b6ab09 appid={12e7fbe8-ba1d-40f9-ba4e-fe6c60a7a7e0}
```

### **Additional Notes:**

1. **New Field in controller.config:**
- A new field, SqlConnectionStringProperties, has been added.
-  If you need to support an encrypted channel to the database, provide a value in this field, e.g., "SqlConnectionStringProperties": "Encrypt=yes;".

2. **Firewall Rules for Studio Connectivity:**
- If you are unable to connect to the controller machine via the Local’s Studio, set up inbound/outbound rules for port 9006 on the controller machine.

### **Key Troubleshooting Areas and Steps to Solve:**

**Handling Certificates and Firewall:**
- What Might Go Wrong:** Issues can arise if certificates are not generated or installed correctly, or if firewall settings block the required ports.

- What to Do:
- Ensure that all paths in the commands are correct when generating and installing certificates. Certificates should be installed in the right location (Local computer for the Controller and Current User > Trusted Root for Studio).
- For the firewall, make sure that ports 9006 and 9002 are allowed through your firewall settings. If there's a connection issue, check the firewall rules and test the connection using the provided URLs.

**Specifying the Common Name (CN) Correctly:**
- What Might Go Wrong:** If the CN (Common Name) field does not accurately match the IP address or domain name of your Leapwork Controller, the certificate might not be valid, leading to connection issues between the Controller and other components.

- What to Do:** Ensure that the CN field is set to the exact IP address or domain name of the Leapwork Controller in your current environment. Double-check this information to avoid any discrepancies that could disrupt secure communications.

By following these steps, you can ensure that your Leapwork environment is secured with encrypted communications, providing a safer and more reliable setup.

If you have any questions, contact our [Priority Support](mailto:prioritysupport@leapwork.com).