From 3b16b57e070fb720c85995eef4336fc18d078ce7 Mon Sep 17 00:00:00 2001 From: Britton Riggs <104870596+briggs-octo@users.noreply.github.com> Date: Fri, 24 Jul 2026 10:18:29 -0700 Subject: [PATCH 1/3] Update SSL binding documentation to match UI --- .../expose-the-octopus-web-portal-over-https.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/pages/docs/security/exposing-octopus/expose-the-octopus-web-portal-over-https.md b/src/pages/docs/security/exposing-octopus/expose-the-octopus-web-portal-over-https.md index 000bcbc752..199abf7dad 100644 --- a/src/pages/docs/security/exposing-octopus/expose-the-octopus-web-portal-over-https.md +++ b/src/pages/docs/security/exposing-octopus/expose-the-octopus-web-portal-over-https.md @@ -74,9 +74,9 @@ The approach for updating an existing binding requires that we take a slightly d 1. Open the **Change bindings...** screen, as in [Changing Your Web Portal Bindings Manually](#change-web-portal-bindings) steps 1 & 2. -1. Select the binding that you are interested in updating the SSL Certificate for and click **Add...** to open the details. Note these details and click **OK** to return to the binding list. +1. Click **Remove** to remove the existing binding that needs to be replaced. -1. Click **Remove** and then **Add...** to recreate the binding, using the details from the previous step. When selecting the SSL Certificate, select the desired certificate. Click **OK** to return to the bindings list. +1. Click **Add...** to recreate the binding, and choose the relevant certificate via the **Select...** option in the `Add Binding` pop-up. Click **OK** to return to the bindings list. ![](/docs/img/security/exposing-octopus/images/updatessl.png) From d25f079d4decb89c74ba0a1bc4839897c8134b8c Mon Sep 17 00:00:00 2001 From: Britton Riggs <104870596+briggs-octo@users.noreply.github.com> Date: Fri, 24 Jul 2026 10:26:13 -0700 Subject: [PATCH 2/3] Adding alt text to images --- .../expose-the-octopus-web-portal-over-https.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/src/pages/docs/security/exposing-octopus/expose-the-octopus-web-portal-over-https.md b/src/pages/docs/security/exposing-octopus/expose-the-octopus-web-portal-over-https.md index 199abf7dad..a40e05e727 100644 --- a/src/pages/docs/security/exposing-octopus/expose-the-octopus-web-portal-over-https.md +++ b/src/pages/docs/security/exposing-octopus/expose-the-octopus-web-portal-over-https.md @@ -28,17 +28,17 @@ You can use your own SSL certificate which could be signed by any trusted Certif 1. On the "Select Computer" page of the Wizard, select the **Local computer**, then click **Finish**. Click **OK** to close the Add/Remove Snap-ins dialog. 1. You can either import the certificate to the **Personal** store, or the **Web Hosting** store (this store may or may not exist on your server). Expand to the Certificates directory, then open the import wizard: - ![](/docs/img/security/exposing-octopus/images/3278100.png) + ![Certificate Management Console](/docs/img/security/exposing-octopus/images/3278100.png) 1. Follow the steps in the wizard to import your certificate. Your certificate will normally be in a .**PFX** file, and it should include both the **public** X.509 certificate, and the **private key** for the certificate. 1. Once the certificate is imported, double click the certificate to bring up the properties. You should see an icon indicating that the private key has also been imported: - ![](/docs/img/security/exposing-octopus/images/3278099.png) + ![Certificate Details](/docs/img/security/exposing-octopus/images/3278099.png) 1. If all these requirements have been met (**private key** imported, either the **Web Hosting** or **Personal** stores, in the **Local Computer** scope), the certificate should appear when you select to use an existing certificate when adding your HTTPS binding: - ![](/docs/img/security/exposing-octopus/images/ssl.png) + ![Octopus Add Bindings Pop-Up](/docs/img/security/exposing-octopus/images/ssl.png) ### Let Octopus generate a self-signed certificate @@ -54,15 +54,15 @@ If you are bringing your own SSL certificate, or want to configure a complex set 1. Open the **Octopus Manager** application on the Octopus Server. You'll find this in the start menu. - ![](/docs/img/security/exposing-octopus/images/3278103.png) + ![Octopus Manager App](/docs/img/security/exposing-octopus/images/3278103.png) 1. From Octopus Manager, you can launch a wizard to modify the bindings that are associated with the Octopus Web Portal: - ![](/docs/img/security/exposing-octopus/images/bindings.png) + ![Octopus Manager Change Bindings](/docs/img/security/exposing-octopus/images/bindings.png) 1. In the Web Bindings wizard, click **Add...** to add a new binding, and choose the HTTPS scheme. Other options such as the port can also be configured here. - ![](/docs/img/security/exposing-octopus/images/addingssl.png) + ![Octopus Manager Add Binding](/docs/img/security/exposing-octopus/images/addingssl.png) Since HTTPS requires an SSL certificate, you can either choose to generate a new, self-signed (untrusted) certificate, or to select an existing certificate. Self-signed certificates are useful for testing or to achieve encryption without trust, but for production use we recommend using a trusted SSL certificate. @@ -78,7 +78,7 @@ The approach for updating an existing binding requires that we take a slightly d 1. Click **Add...** to recreate the binding, and choose the relevant certificate via the **Select...** option in the `Add Binding` pop-up. Click **OK** to return to the bindings list. - ![](/docs/img/security/exposing-octopus/images/updatessl.png) + ![Octopus Manager Add Binding Pop-Up](/docs/img/security/exposing-octopus/images/updatessl.png) > At this point, the bindings have not changed yet, as we haven't yet applied this change to the server. @@ -93,7 +93,7 @@ A common scenario when hosting the Octopus Server is to redirect all requests in 1. Test you can use Octopus with either `http://` or `https://` schemes without being redirected (the scheme stays the same) - this proves both endpoint bindings are working as expected. 1. Configure Octopus to `Redirect HTTP requests to HTTPS` - you can do this using the Octopus Server Manager application where you configure the bindings as soon as you have configured an HTTPS binding. - ![](/docs/img/security/exposing-octopus/images/forcessl.png) + ![Octopus Web Bindings Wizard - Force SSL](/docs/img/security/exposing-octopus/images/forcessl.png) ## HTTP strict transport security (HSTS) {#hsts} From d5fe8815ca207fcd5d0ffe767c3822aab42266d6 Mon Sep 17 00:00:00 2001 From: Britton Riggs <104870596+briggs-octo@users.noreply.github.com> Date: Fri, 24 Jul 2026 10:33:10 -0700 Subject: [PATCH 3/3] Fixing formatting to match rule expectations --- .../expose-the-octopus-web-portal-over-https.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/pages/docs/security/exposing-octopus/expose-the-octopus-web-portal-over-https.md b/src/pages/docs/security/exposing-octopus/expose-the-octopus-web-portal-over-https.md index a40e05e727..9defd847ee 100644 --- a/src/pages/docs/security/exposing-octopus/expose-the-octopus-web-portal-over-https.md +++ b/src/pages/docs/security/exposing-octopus/expose-the-octopus-web-portal-over-https.md @@ -101,7 +101,7 @@ HTTP Strict Transport Security is an HTTP header that can be used to tell the we **Octopus 3.13** and above can send this header, but due to the potential pitfalls, it is opt-in. To switch it on, run the following commands on your Octopus Server: -``` +```powershell PS \> Octopus.Server.exe configure --hstsEnabled=true --hstsMaxAge=31556926 PS \> Octopus.Server.exe service --stop --start ``` @@ -115,7 +115,8 @@ We highly recommend using a short value for `hstsMaxAge`, like 1 hour (3600 seco :::div{.warning} Please note that enabling HSTS comes with its own challenges. For example: -* Untrusted / self-signed certificates will not work with HSTS - the certificate chain needs to be fully trusted by the browser. -* Your Octopus Server must be hosted on standard ports - HTTP on port 80 and HTTPS on port 443. -* Reverting from HTTPS to HTTP will not be simple - each browser will need to be manually reconfigured to remove the HSTS entry. +- Untrusted / self-signed certificates will not work with HSTS - the certificate chain needs to be fully trusted by the browser. +- Your Octopus Server must be hosted on standard ports - HTTP on port 80 and HTTPS on port 443. +- Reverting from HTTPS to HTTP will not be simple - each browser will need to be manually reconfigured to remove the HSTS entry. + :::