Skip to main content

Panel address and HTTPS

Two separate addresses​

DCP and DerScanner are separate web services. HTTPS on DCP does not install the same certificate in DerScanner. Use the product address shown after installation and the DCP address for administration.

Preparation​

Obtain the DNS name, an available port, certificate and matching private key. The certificate must cover the chosen name. Prepare the trust chain and restrict access to the key. Agree network access with the administrator.

DCP procedure​

  1. Open the current panel and ensure no operation is active before changing its service.
  2. Record the current address and launch method. For a system service, apply changes to its persistent startup configuration.
  3. Place the certificate and key on the server. Do not upload a TLS key through the SSH server form.
  4. Configure DCP startup with --listen, --cert and --key. These are panel startup options, not fields on Settings.
  5. Manual startup example: sudo dcp ui --listen 0.0.0.0:9443 --cert /etc/dcp/tls/fullchain.pem --key /etc/dcp/tls/privkey.pem. Substitute real paths. Do not start a second instance on an occupied port.
  6. Restart the panel using the procedure for its service and open the new HTTPS address.
  7. Check the certificate name, validity period, trust chain and sign-in.
  8. Check access from the administrator's workstation and service startup after a planned server reboot.

Troubleshooting​

Check the listening address, DNS, firewall, port and certificate/key pair. Retain SSH access to restore the previous configuration. Disabling TLS verification is not a permanent access solution.

DerScanner​

Configure the product address and TLS separately according to its deployment. dcp ui options do not configure the product web server.

Applying settings to an existing panel​

Running dcp ui while an instance is active can return a new sign-in link without applying a new address or certificate. Update the persistent service configuration, then stop and start that service in the maintenance window. A new sign-in link does not prove TLS changed; inspect the certificate actually served after restart.