# Enable HTTPs for Blnk Server

Turn on server.ssl, point your domain at Core, and verify HTTPS before you put traffic on it.

Deploy your Blnk server with HTTPS so traffic between clients and Core is encrypted. Blnk issues a Let's Encrypt certificate when you set `server.ssl` to `true` and point a domain at the server.

This guide helps you set up HTTPS for a Core instance you operate yourself. You need a basic understanding of Docker, Compose, and domain management.

## Before you start

Make sure that the Blnk server has been successfully deployed and is running on your machine.

<Steps>
	<Step title="Update your configuration file">
		Set `server.ssl` to `true` and provide the domain, notification email, and certificate storage path.

		<CodeGroup>
		```bash blnk.env
		BLNK_SERVER_SSL=true
		BLNK_SERVER_SSL_DOMAIN=yourdomain.com
		BLNK_SERVER_SSL_EMAIL=your-email@example.com
		BLNK_CERT_STORAGE_PATH=/var/lib/blnk/certs
		BLNK_SERVER_PORT=5001
		```

		```json blnk.json
		{
		  "server": {
		    "ssl": true,
		    "domain": "yourdomain.com",
		    "ssl_email": "your-email@example.com",
		    "cert_storage_path": "/var/lib/blnk/certs",
		    "port": "5001"
		  }
		}
		```
		</CodeGroup>

		When `ssl` is `true`, Blnk starts an HTTPS listener on `server.port`, obtains a certificate for `server.domain`, and stores it in `cert_storage_path`. 
		
		If a certificate cannot be issued, the server fails to start. It does not fall back to HTTP.

		See [HTTPS settings](/operating/configuration/server-security#https-settings) for every field and default.
	</Step>
	<Step title="Ensure your domain points to your server">
		Confirm that the DNS settings for your domain point to the IP address of your server.

		This is required for Let's Encrypt to verify the domain and issue a certificate. If `domain` is empty, Blnk defaults to `localhost`, which cannot receive a public certificate.
	</Step>
	<Step title="Start your Blnk server">
		With your configuration file updated, start your Blnk server using Docker Compose.

		```bash
		docker compose up
		```

		The process validates domain ownership, issues a certificate, and starts the HTTPS listener. Startup logs include the scheme (`https`) so you can confirm TLS is on.
	</Step>
	<Step title="Verifying your HTTPs set-up">
		Once your Blnk server is running, verify the HTTPS setup with `curl`:

		```bash
		curl https://yourdomain.com:5001 -I
		```

		You should see a successful HTTPS response. An HTTP client against the same port will fail the TLS handshake.

		<Warning>
		Do not leave `"ssl": true` in config while your clients still use `http://`. After 0.15.4 those clients will fail. Set `ssl` to `false` if you intend to keep HTTP.
		</Warning>
	</Step>
</Steps>

## Next steps

With HTTPS enabled, traffic to your Blnk server is encrypted. Consider the following as you continue:

1. **Monitor and renew certificates:** Blnk automates issuance. Monitor your domain and certificates for expiry and keep `cert_storage_path` writable so renewals can be stored.

2. **Security best practices:** Keep software up to date, manage access controls, and monitor for unauthorized access. Enable [secure mode](/operating/secure-blnk) for API authentication.

<RelatedTopics
  items={[
    { title: "HTTPS settings", href: "/operating/configuration/server-security#https-settings" },
    { title: "Secure Blnk", href: "/operating/secure-blnk" },
    { title: "0.15.4 migration", href: "/migrations/core/v15-4-migration" },
    { title: "Deploy", href: "/deploy" },
    { title: "Install Blnk", href: "/install" },
  ]}
/>