Webservice

All frontend services are provided by the openxpki-clientd service, it starts a second process which listens to requests via a unix socket and talks to the backend via another socket.

Reverse Proxy

You must use a webserver as reverse proxy to forward incoming HTTP requests to the backend. A ready-to-use Apache configuration is included in contrib/apache2-openxpki-site.conf.

The configuration expects:

  • TLS key: /etc/openxpki/tls/private/openxpki.pem

  • TLS certificate (with chain): /etc/openxpki/tls/endentity/openxpki.crt

  • Root certificates for TLS client auth: /etc/openxpki/tls/chain/ (after placing files: c_rehash /etc/openxpki/tls/chain/)

**Note: The webserver does not start when the chain path is empty! If you do not need TLS client authentication, remove the related settings from the configuration.

Frontend Server

After you have configured the above, start the frontend service with:

systemctl start openxpki-clientd