ac303f8bb9baf25d201ad8530d4560fa3175fcd9 galt Wed Jan 19 16:31:45 2022 -0800 Adding documentation about configuring SSL web server certs for use with openssl and the UCSC Genome Browser. refs #28792 diff --git src/hg/htdocs/goldenPath/help/hgTrackHubHelp.html src/hg/htdocs/goldenPath/help/hgTrackHubHelp.html index c4769ab..6ac516e 100755 --- src/hg/htdocs/goldenPath/help/hgTrackHubHelp.html +++ src/hg/htdocs/goldenPath/help/hgTrackHubHelp.html @@ -1091,16 +1091,66 @@ and then edit your hub.txt, genomes.txt, and trackDb.txt appropriately. One advantage to using Figshare is their emphasis on usage statistics, so institutional accounts can see how often their hubs and tracks are being accessed by others.

Note that Figshare does not use filenames as part of the URLs, therefore bigDataUrl files that require a separate index file, like VCFs and BAM files, must have their index file location specified with a bigDataIndex. This keyword is relevant for Custom Tracks and Track Hubs. You can read more about bigDataIndex in the TrackDb Database Definition page.

For more information on using Figshare, please see their Support Portal.

+ + +

Configuring your own HTTPS server

+

+

The most popular web servers are Apache and NGINX. +

+

+Instructions for setting up these popular web servers are found all over the web, so we will not cover that here.

+ +

+Certs and Security
+ +As security on the Internet is becoming increasingly important, SSL certificates are required for proper server installation. +The certificate validation step helps stop Man-In-The-Middle attacks by ensuring that the connection goes to the correct server +and not some fake site. The process requires SSL certificates that have not expired and whose domain name matches the domain name +specified in the HTTPS URL.

+

+Our networking software uses the very popular open source library openssl 1.0.
+Please ensure that TLS1.2 is allowed, since it is fast and secure and compatible with openssl 1.0. +

+ +FREE CERT PROVIDER

+There are groups that provide free web certs, including the popular LETSENCRYPT

+ + +Testing your site certs

+

+

+curl uses openssl +

+curl https://yourdomain.com/yourhub/hub.txt
+
+

+If curl can fetch your hub.txt URL without errors, then the certs will work with the UCSC Genome Browser.

+

+

+For a deeper level of debugging, use the open ssl client command

+

+openssl s_client -connect yourdomain.com:443 -servername yourdomain.com
+
+

+Various online SSL Server Test sites have great detailed documentation about your web site certs and configuration

+

+https://www.ssllabs.com/ssltest/
+https://www.ssllabs.com/ssltest/analyze.html?d=yourdomain.com&latest
+
+

+Feel free to contact UCSC Genome Browser for help if you are seeing certificate validation error messages you do not understand.

+ +