Setting up secure HTTP with AMP

There are a number of methods that can be used to set up secure HTTP (HTTPS) within AMP depending on your use case.

Note that with AMP Enterprise, use of HTTPS is mandatory.

Reverse proxy via nginx (Recommended, Linux only)

If you use the default GetAMP.sh setup script, this is handled for you automatically. If you need to do this after the fact, then you simply run the following as root:

ampinstmgr setupnginx my.domain.com 8080

Where 8080 is the port that ADS is currently bound to. This will automatically configure nginx and run certbot to secure the domain.

Internal HTTPS implementation

AMP has built in support for HTTPS with its internal application server. AMP requires a certificate in PFX format with a passphrase. You can use ampinstmgr convertcertificate to convert a standard .cert + .key file pair into a PFX on Linux systems.

The main advantage is that no additional software is required, however it's not suitable for use with LetsEncrypt as AMP has to be restarted to swap out the certificate.

Linux Manual Configuration

This method is optimal if you already have your certificate in use with another webserver already.

Open /home/amp/.ampdata/instances/ADS01/AMPConfig.conf while ADS is stopped and edit the following lines:

Webserver.CertificatePath=/path/to/your/certificate.pfx
Webserver.CertificatePassword=y0urc0mplexpa5$word

Windows

Install the certificate to your system into the local machine store, and then view the certificate to get its serial number. Once you've done this edit the following lines to your AMPConfig.conf file for ADS:

Webserver.CertificateSerial=CERTIFICATESERIALNUMBERGOESHERE

Re-configuring existing instances

All existing instances other than ADS01 will need their authentication server updated to your ADS installations new URL.

Your login section for AMPConfig.conf for each instance should look like this, make sure to change ads.somedomain.com to your chosen domain.

################################
# Login
################################
Login.UseAuthServer=True
# Login.AuthServerURL - The URL for the ADS instance providing authentication when using UseAuthServer
Login.AuthServerURL=https://ads.somedomain.com/
Login.LDAPAllowAuthOnAnyDomain=False
Login.LDAPAuthDomain=

Also in ADS, under Configuration -> New Instance Defaults you need to update the Default Auth Server URL to be the new URL of your ADS installation.