OK, so let's add the SSL certificate now, but this all use a free certificate service from Cert BOP
that will then fix up the URL problem here, where it says not secure.
And looking at this, we will no longer access our URL by a hasty FTP, but by a hasty https.
OK, so follow the instructions on the Cert bot website.
So I've just outlined what I'm doing down here.
So if we go to the website.
So my hasty FTP website is running Engine X on Ubuntu Twenty.
OK, so it gives you specific instructions below.
Ubuntu twenty point zero for Altius already has Snapdeal's installed, so we I need to do that.
The future version, the version coming out soon of rebounded twenty two point zero for Altius will
also have Snapdeal installed, so we can just ensure that our version of Snapdeal is up to date.
A copying that and going on our server using S-H.
OK, so I want to find a server that got from digital ocean the right click.
Sudo snap install core sudo snap refresh.
Cool.
That's just making sure that I had the latest version of Snap.
That's good that I don't have to remove any older versions, so I didn't have any installed support.
Place sudo snap install support.
Very good.
We need to prepare the support command so that we can execute it from the command line.
Now we just run sudo support Engine X like that because we're using an Engine X server, so it will
ask us to put in some information, which we have to do.
You need to agree, yes, you don't have to share your information now because I have created a configuration
before for Bafana.
Dress code dot net, it has found it so says which name would you like to activate hastily before for
press number one?
So.
Now it's requesting a certificate.
Now it's important that your domain name has fully propagated when you run that step because it will
verify the domain name points to the same IP address from different locations in the world.
So that's worked for me.
So says successfully receive certificate certificate is saved at ADC.
Let's encrypt live performance the code on a full chain PM and I approve keeping him.
So for me, it's been successful.
Now, if I just visit Safana ESP Code Dot Net in the browser just like that, I live off the database.
Open up a browser and just put that in press.
Enter it is automatically chosen https and I've got a padlock, so that looks much more professional.
Now it's all optional, whether you do this or not.
This may not be important for you, but if you're managing a Gervonta service for clients, it's important
that it looks professional.
That's one of the things that you can do.
Having a domain name is also useful when it comes to sending out email alerts because your email provider
will do a reverse DNS look up on your IP address and it should resolve to the same name of the server
that sent the email address.
I'll show you that later.
Now, to understand what support has done, if we just clear this support has taken that configuration
file that was in ETSI sites enabled so CTP, ATC and genetics sites enabled.
And if we just look at this fall here or FORNISCE Code Dot need to confirm or see what it did, though
we can just write Cat, which allows us to read text files or foreign stories, be code on it or confirm
what we can see that it has modified the file a little bit.
This is what we originally wrote down here.
The server name Gryphon.
I speak code dot net, but instead now it's returning a 44 not found, but before it gets to that point.
If host equals Safana s code dot net, it will do a 3.1 redirect back to our browser, which tells the
browser to use hACE2 TPS colon slash slash instead.
Whatever the host and the error was okay, so poor it is still being used, but it's being used to return
a three one redirect pointing to the hate https version of the website support, right?
Or that for us if I go up higher server name is California s code dot net proxy pass to hate it to be
localized 3000.
So that's still good.
We're listening now on Port 443.
That's the IPv6 version.
And listen for for three SSL, that's the IP full version.
Now, I don't have IP version six enabled on my digital ocean server, so that line is pretty much going
to be ignored.
But you might have that on your server one day.
And here there are some more commands pointing to the location of the certificates that we just stored
full time PM and eight pm.
Excellent.
So support is doing a whole lot of things for us now.
These certificates don't last very long, but behind the scenes Snap D and support are both making sure
that that certificate gets updated when it is about to expire.
So excellent.
Okay, so if you're using IWC, you probably have to create a new incoming rule in your security group
for Port 443.
You should also leave Port eight open, and it's safe to remove the rule that was credited.
Gaining support 3000.
Now, since I'm using digital ocean port, three thousand is still open, so this will actually still
work if I did call and three thousand put that CTP.
All right.
I don't really want that to work anymore.
I can actually create a firewall rule to block three thousand on my digital license server.
Okay, so since I'm using Ubuntu, just going to clear a screen, I can list any IP tables rules that
I have IP table.
So there are none.
OK, so first thing I want to do is I want to still allow Port 3000 to be called internally because
we have the Engine X proxy forwarding to local host three thousand so I can use that command their IP
tables.
I input TCP source one 20 seven zero zero one destination port 3000 accept and drop everything else,
so anything else trying to call 3000 will be dropped into so IP tables.
Well, we now have a rule for Port 3000 so we can accept Port 3000 if it's being asked from local host
and drop the connection if it's being asked from anywhere else.
So now if I try to visit that address Gryphon ISP code on Netcom 3000 directly, it will eventually
time out.
And that's using a thing called IP tables, because I haven't enabled the firewall and digitalization,
I'm doing that because unlike IWC or other cloud providers, Ocean doesn't force a firewall in front
of your servers automatically.
You have the option to manually block ports using IP tables.
OK, so that's timed out eventually, but if I was to try and just visit that address in another window
doesn't matter for Typekit CPTPP, even it gets automatically forward on the hastebin sacrifice be carried
on it.
So it's much more provisional anyway.
So optional.
Excellent.
In the next section, we'll create our first data source.
Excellent.