TLS / HTTPS Setup

Users expect a padlock. This guide puts a reverse proxy with automatic TLS in front of a self-hosted OpenScan.AI deployment.

Overview

The explorer’s frontend and API listen on plain HTTP ports (3000 and 4000). A reverse proxy terminates TLS, routes traffic by hostname, and renews certificates automatically. We’ll use Nginx with Certbot (Let’s Encrypt); Caddy or Traefik work just as well.

Prerequisites

• A domain pointing at your server: explorer.yourchain.example → your server’s IP
• Ports 80 and 443 open to the internet
• The explorer stack running (see Containerized Deployment)

Step 1 — Install Nginx and Certbot

sudo apt update
sudo apt install -y nginx certbot python3-certbot-nginx

Step 2 — Configure Nginx

Create /etc/nginx/sites-available/explorer:

server {
    listen 80;
    server_name explorer.yourchain.example;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /api/ {
        proxy_pass http://127.0.0.1:4000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Enable it:

sudo ln -s /etc/nginx/sites-available/explorer /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

Step 3 — Issue the Certificate

sudo certbot --nginx -d explorer.yourchain.example

Certbot edits the Nginx config to serve HTTPS and sets up automatic renewal. Verify renewal works:

sudo certbot renew --dry-run

Step 4 — Verify

• https://explorer.yourchain.example loads the explorer without warnings.
• https://explorer.yourchain.example/api/v2/blocks returns JSON.
• Run the Explorer Verification checklist against the public URL.

Notes

• Certificates renew automatically; check renewal status with sudo certbot certificates.
• If you change domains, issue a new certificate for the new name and update DNS first.
• Hosted EaaS instances get TLS managed for you — see Custom Domain Service.