HTTPS Configuration

1. Overview

HTTPS protects Centrify 360 traffic in transit.
It is especially important when Centrify 360 is accessed from other machines, from Business Central SaaS, or from the public internet.

In practical terms, HTTPS matters for:

  • the PostgreSQL connection used by reporting tools,

  • the Orchestrator URL used by Business Central, and

  • the AI Assistant URL used by end users and Microsoft sign-in.

HTTPS is strongly recommended for production deployments.
If your deployment is reachable outside the local machine, plan to use HTTPS with a valid certificate.

2. Managed SaaS vs On-Premise

2.1. Managed SaaS Installation

For Managed SaaS Installation, HTTPS is available out of the box.

  • Public application endpoints are exposed over HTTPS.

  • You do not need to provide your own certificate for the standard deployment.

  • This is the simplest option for customers who want secure public endpoints without managing certificates themselves.

2.2. On-Premise Installation

For On-Premise Installation, you are responsible for the certificate used by the deployment.

During installation:

  • If you provide a certificate (.crt) and private key (.key), Centrify 360 uses them.

  • If you do not provide them, the installer generates a self-signed certificate automatically.

  • The generated public certificate is also written to appInstallationDir/config/public.pem.

A self-signed certificate is acceptable for testing, internal labs, and initial setup.
For production or internet-facing deployments, use a certificate issued by a trusted certificate authority.

3. What HTTPS affects

3.1. PostgreSQL

If you connect reporting tools such as Power BI to PostgreSQL, you should expect to use a secure connection.
If PostgreSQL is reachable from other machines, secure network access and firewall rules are also important.

3.2. Orchestrator

Business Central connects to the orchestrator by URL.
For production deployments, use the HTTPS orchestrator URL whenever possible.

Managed SaaS provides this automatically.
On-premise customers should prefer HTTPS over HTTP, especially when Business Central or users connect from outside the server.

3.3. AI Assistant

HTTPS is especially important for the AI Assistant because it is user-facing and uses Microsoft OAuth sign-in.
For production use, the AI public URL should be an HTTPS URL that matches your certificate and public domain.

If you plan to expose the AI Assistant to users over the web, use a valid HTTPS URL with a trusted certificate.

4. Certificate requirements for on-premise deployments

For a proper production HTTPS setup on-premise, you typically need:

  1. A public machine IP or reachable public endpoint.

  2. A DNS record that points your domain or subdomain to that public IP.

  3. A certificate issued for that domain name.

  4. The matching private key.

Example:

  1. Point bi.yourcompany.com to your public server IP.

  2. Request a certificate for bi.yourcompany.com from a trusted certificate authority.

  3. Provide the certificate and key during Centrify 360 installation.

  4. Configure your public URLs to use that domain.

In most cases, you first map your public IP to a domain, then request the certificate for that domain.

5. Security recommendations

  • Prefer HTTPS everywhere for production.

  • Use a trusted CA-issued certificate for any public or user-facing deployment.

  • Avoid exposing PostgreSQL publicly unless required.

  • Restrict inbound firewall rules to only the ports and source systems you need.

  • For AI deployments, make sure the public URL, redirect URI, and certificate all match.

6. Related documentation

For deployment-specific steps, also see: