Directly on the device (kiosk screen), the user interface runs on http://localhost:5000. From other computers on the network, you can additionally reach the same interface over an encrypted connection:

https://<edge-ip>:5443

Both access paths show the same application with the same users and permissions.

Why HTTPS on a separate port?

Some embedded applications require what browsers call a secure context. That is given for http://localhost on the device itself, but for access via a LAN IP it is only available over HTTPS. The edge therefore provides both access paths (in the GMN stream as of firmware 2.1.1): HTTP on port 5000 (local/kiosk) and HTTPS on port 5443 (remote access).

The edge’s certificate

Edges rarely have internet access, so a certificate from a public certificate authority is not an option. Instead, the edge brings its own certificate authority, the edge CA. It is created on first startup, stays the same for the life of the device, and issues the certificate for port 5443. That certificate covers all of the edge’s private IP addresses; it is valid for a little over a year and the edge renews it in good time by itself, and also on its next start after an IP address has been added.

As long as your computer does not trust the edge CA, the browser shows a warning (“Your connection is not private”). You have three options:

1. Confirm the warning (“Advanced” → “Proceed to …”) — enough for occasional access.
2. Trust the edge CA once — no more warnings after that, not even after a renewal or an IP change. See below.
3. Install a certificate from your company CA — if your IT runs its own certificate authority that your computers already trust. See Your company CA’s certificate.

Trusting the edge CA

The edge CA can only vouch for private addresses and local names (10.x, 172.16–31.x, 192.168.x, names ending in .local, .lan, .internal, .intranet, .intern, .corp, .home.arpa). This is written into the certificate itself and checked by the browser. Even someone who got hold of its key could not use it to impersonate a website on the internet.

1. Sign in as an administrator and open Settings → HTTPS certificate.
2. Note the Fingerprint (SHA-256) and click Download edge CA. You get the file edge-ca.crt.
3. Install the file on the computer as a trusted root certification authority:
   • Windows (applies to Edge and Chrome): double-click edge-ca.crt → Install Certificate → Local Machine → Place all certificates in the following store → Trusted Root Certification Authorities. Before finishing, Windows shows the fingerprint — compare it.
   • Many computers at once: your IT can distribute the file by group policy (Computer Configuration → Policies → Windows Settings → Security Settings → Public Key Policies → Trusted Root Certification Authorities).
   • macOS: open the file → keychain System → in the certificate under Trust, set “SSL” to Always Trust.
   • Firefox (its own certificate store): Settings → Privacy & Security → View Certificates → Authorities → Import and tick “Trust this CA to identify websites”.
4. Restart the browser and open https://<edge-ip>:5443 — no warning.

Every edge has its own CA. With several edges, trust each one — or use a certificate from your company CA for all of them.

Host names

If you reach the edge by a name instead of its IP (such as edge01.local or an entry in your company’s DNS), enter it under Settings → HTTPS certificate → Host names. Names with the local endings listed above go into the edge’s certificate right away. The edge CA may not vouch for other names such as edge01.company.com; they only go into signing requests — for such names you need a certificate from your company CA.

Your company CA’s certificate

If your IT runs its own certificate authority (for example Active Directory Certificate Services), you can use a certificate from it. The edge offers two ways.

Way 1: signing request (recommended)

The private key is created on the edge and never leaves it.

1. Settings → HTTPS certificate → Your own certificate: enter the host names (separated by commas), tick Include the IP addresses of this edge if needed, and enter the organization.
2. Create signing request, then Download request (edge.csr) or Copy to clipboard.
3. Your IT issues a web server certificate from it. With a Windows CA, for example:

   certreq -submit -attrib "CertificateTemplate:WebServer" edge.csr edge.cer

4. On the same page, choose the file you received (.cer, .crt, .pem, or the chain as .p7b) and click Check and install. The edge matches the certificate to the waiting key.

While a request is open, the page shows it. Discard request deletes the waiting key; a certificate issued for it can then no longer be installed.

Way 2: import certificate and key

If your IT has already created certificate and key, upload both:

• PKCS#12 (.pfx, .p12) — enter the password in the field next to it.
• PEM — certificate, intermediate certificates and private key, in one or several files; an encrypted key needs its password.

What the edge checks before activating

A certificate is only activated if it can work. It is refused if

• the private key is missing or does not belong to the certificate,
• it has expired or is not yet valid (then also check the edge’s date and time),
• it is a CA certificate, names no host (subject alternative name), or is not meant for servers,
• the key is too weak (RSA below 2048 bits) or it is signed with SHA-1,
• the chain supplied with it does not fit together.

A warning — the certificate is installed nevertheless — appears if it covers neither an address nor a configured host name of the edge, an intermediate CA seems to be missing, it is valid for more than 825 days or does not state its use (Apple devices refuse the last two), or it expires in less than 30 days.

After Check and install, the certificate applies from the next connection; no restart is needed. Reload the page.

Which computer gets which certificate

The edge decides per connection:

• Access by a name your certificate lists (also via a wildcard such as *.company.com) → your certificate.
• Access by an IP address → your certificate only if it contains all IP addresses of the edge; otherwise the edge certificate. When opened by IP, the browser does not tell which address it dialled; a certificate with only one of them would cause a warning on every other port.
• anything else → the edge certificate.

If your certificate should also apply when the edge is opened by IP, tick Include the IP addresses of this edge in the request — or open the edge by a name the certificate lists.

Expiry and renewal

30 days before expiry, the diagnosis reports code 1012; with fleet management connected, the message appears there too. Renew the same way as the first time (new request or import). The edge keeps serving an expired certificate: the browser warns, but you still get into the interface to install a new one.

If your certificate ever cannot be loaded, the edge automatically falls back to its own and reports 1013. Use the edge certificate again removes your certificate permanently. The same code appears if the edge could not store or renew its own certificate; it then carries on with a temporary certificate and retries by itself.

Closing the unencrypted access

Port 5000 (HTTP) is open out of the box. To allow only encrypted access over the network, close it under Settings → Firewall — see Configure the firewall. The kiosk screen accesses the interface locally and is not affected.

Multiple network ports

An openXEdge has up to three LAN ports with their own IP addresses (typically: office network, machine subnet, service port). The interface — including all embedded applications — is reachable via every one of these addresses; simply use the IP of the port your computer is connected to. The port assignment is described in Wiring and connections.

Troubleshooting

• Page does not load → Are you on the right subnet? The IP addresses of all ports are shown under Settings → Network once signed in, also on the edge’s own display.
• Embedded view stays empty (only with HTTP via LAN IP) → Use the HTTPS access path https://<edge-ip>:5443.
• Warning although the edge CA is installed → Restart the browser completely. If you reach the edge via a public IP or a name without a local ending, the edge CA cannot vouch for it; the HTTPS certificate page lists such addresses. Firefox manages certificates separately from Windows.
• Warning after a firmware update from a version before the edge CA → One time only: the edge has replaced its old self-signed certificate with one from the edge CA. Trust the edge CA as described above.