Knowledge Base

Find answers, guides, and best practices for ComfortClick bOS.

Open in Confluence

Custom HTTPS Certificate

bOS Server provides its HTTPS service (port 443 by default) with a self-signed ComfortClick certificate. Devices do not trust it, and it does not contain the host name or IP address of your server, so web browsers show a security warning.

You can replace it with your own certificate. bOS Server loads the certificate from a file every time it starts, so no settings need to change.

Table of contents

Requirements

  • One PFX file (.pfx or .p12) that contains the certificate and its private key.

  • The password password. The PFX file must be protected with exactly this password, all lowercase.

  • An RSA key of 2048 bits or more. ECDSA keys work for HTTPS, but not for ETS remote programming.

  • Server authentication. If the certificate has an Enhanced Key Usage field, it must include Server Authentication. Web server certificates always do.

  • Every address. The certificate lists every host name and IP address that users connect with, for example 192.168.1.10, bos.example.local or your dynamic DNS name.

  • Trusted by devices. The devices that connect must trust the certificate or the CA that issued it.

Warning: With any PFX password other than password, bOS Server does not start at all. It does not fall back to the default certificate.

Installing the Certificate

bOS Server runs as the ComfortClick bOS Service Windows service and reads the certificate from this folder:

C:\Windows\System32\config\systemprofile\AppData\Roaming\BOS\BOSServer\Local\

bOS Server reads the file only when it starts. The restart briefly disconnects all users.

  1. Open File Explorer, paste the folder path above into the address bar and press Enter. If Windows says you do not have permission to access the folder, select Continue. This needs administrator rights.

  2. Rename the existing Certificate.pfx to Certificate.pfx.bak, so you keep the original certificate.

  3. Copy your certificate file into the folder and name it Certificate.pfx.

  4. Restart bOS Server: press Win+R, type services.msc and press Enter. Right-click ComfortClick bOS Service and select Restart.

Checking the Certificate

Open https://<server address>/ in a web browser, adding the port if you changed it from 443. Click the padlock and view the certificate: it should be yours, and the browser should show no warning. Check with a browser, because bOS Configurator and bOS Client for Windows accept any certificate.

Troubleshooting

Problem

Cause and fix

bOS Server does not start

The password is not password, the file has no private key, or the certificate is not for server authentication. The error is in Event Viewer > Windows Logs > Application. Fix the file or restore the backup.

The ComfortClick certificate is still shown

bOS Server was not restarted, or the file is in the wrong folder or has the wrong name (for example Certificate.pfx.pfx). bOS Configurator keeps its own Certificate.pfx in your user profile; that is not the one to replace.

The browser still shows a warning

The address you use is not in the certificate, the device does not trust the certificate or its CA, or the certificate has expired. bOS Server does not warn before a certificate expires.

Some devices reject the certificate chain

bOS Server does not send intermediate CA certificates from the PFX file. It sends the intermediate only if it can download it through the certificate's CA Issuers link when it starts; certificates from public CAs contain this link. Let the server reach that link, or install the intermediate CA certificate on those devices.

ETS remote programming fails

Use a certificate with an RSA key.

Going Back to the Default Certificate

Restore Certificate.pfx.bak as Certificate.pfx, or delete Certificate.pfx, and restart ComfortClick bOS Service. Without the file, bOS Server creates a new self-signed ComfortClick certificate at startup.

If you need help, contact the ComfortClick help desk.

Top