Enabling HTTPS in Wt

Category: Security

Wt is a great modern C++ framework for making standalone web pages. As it does not use Apache, Nginx etc, there is not much information on how to serve the pages over HTTPS. Here is a small guide on how to use Lets Encrypt certificates in your Wt applications:

First, install the Lets Encrypt certbot and fetch your certificates

sudo apt-get -y update && 
sudo apt-get -y install certbot && 
sudo certbot certonly --domain <your domain> --standalone --agree-tos

 

 Also, install OpenSSL development files and generate Diffie-Hellman parameters

sudo apt-get -y install libssl-dev && 
sudo openssl dhparam -out /etc/ssl/dh4096.pem 4096

 

When building Wt, make sure SSL is enabled (it should be by ON default..)

cmake ../ <other settings> -DENABLE_SSL:BOOL=ON

 

When starting up your Wt application, use https-listen instead of (or in addition to) http-listen, and reference your certificates

./<application> <other Wt parameters> \
                --servername <your domain> \
                --https-listen 0.0.0.0:443 \
                --ssl-certificate /etc/letsencrypt/live/<your domain>/fullchain.pem \
                --ssl-private-key /etc/letsencrypt/live/<your domain>/privkey.pem \
                --ssl-tmp-dh /etc/ssl/dh4096.pem

 

If your application is expected to have a long uptime, you may want to put a small script in /etc/letsencrypt/renewal-hooks/deploy/ that restarts it when certbot has successfully renewed a certificate.

Articles

Categories