# Open https via public URL **URL:** \ **Category:** Product support\ **Created:** [May 22, 2017, 4:10pm UTC](https://forums.balena.io/t/open-https-via-public-url/994 "2017-05-22T16:10:01Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![nite](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/nite/32/245_2.png) [@nite](https://forums.balena.io/u/nite)\ **Post date:** [May 22, 2017, 4:10pm UTC](https://forums.balena.io/t/open-https-via-public-url/994/1 "2017-05-22T16:10:01Z")
I’ve got a device exposed via the resin vpn/public url. I’d like to serve https from the device itself - however the vpn only proxies port 80 - any chance you could open up 443 as well? ---
**Author:** ![nghiant2710](https://avatars.discourse-cdn.com/v4/letter/n/90db22/32.png) [@nghiant2710](https://forums.balena.io/u/nghiant2710)\ **Post date:** [May 23, 2017, 7:43am UTC](https://forums.balena.io/t/open-https-via-public-url/994/2 "2017-05-23T07:43:25Z")
hey @nite, I don’t think we can since Port 443 is used by our VPN. You can find more details about network requirements on a resin device here [https://docs.resin.io/deployment/network/1.x.x/](https://docs.resin.io/deployment/network/1.x.x/). ---
**Author:** ![nite](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/nite/32/245_2.png) [@nite](https://forums.balena.io/u/nite)\ **Post date:** [May 23, 2017, 9:50am UTC](https://forums.balena.io/t/open-https-via-public-url/994/3 "2017-05-23T09:50:07Z")
Hi @nghiant2710 - so, how would you suggest we proceed? Currently, we’ve got a gap of no ssl from device to resin. Would serving https over another port work from your side, eg. (random pick 4443), either a fixed port you specify, or configure somehow via the dashboard? ---
**Author:** ![imrehg](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/imrehg/32/36_2.png) [@imrehg](https://forums.balena.io/u/imrehg)\ **Post date:** [May 23, 2017, 12:32pm UTC](https://forums.balena.io/t/open-https-via-public-url/994/4 "2017-05-23T12:32:57Z")
What do you use to serve HTTPS on the device? Most servers can be set up to serve on any port, not just default ports, thus you could have a HTTPS server on port 80, that is then forwarded properly. In the same time, can you give us a bit more info on why you need HTTPS in this particular case? Both the device-\>VPN connection (through OpenVPN) and VPN-\>visitor traffic is encrypted already, so there should not need to be doing a second encryption on the device-\>vpn connection. ---
**Author:** ![jmarshall](https://avatars.discourse-cdn.com/v4/letter/j/7993a0/32.png) [@jmarshall](https://forums.balena.io/u/jmarshall)\ **Post date:** [May 23, 2017, 10:30pm UTC](https://forums.balena.io/t/open-https-via-public-url/994/5 "2017-05-23T22:30:41Z")
at the moment just using express.js I think but @nite can confirm. we could serve https over port 80 but unless the device endpoint is not also serving https which I understand is forced your end I’m not sure how the browser would handle it, i guess first pass is try it. On the no need to add encryption because of the Device -\>VPN-\>Visitor traffic route means that there is a high degree of trust placed in [resin.io](http://resin.io) as the proxy operator and only person to have visibility of the devices that operate the VPN-\>visitorTraffic coupling. I imagine certainly in the data collection scenario that asset owners are more than happy for you to provide the management services but will want the assurance that only their own PKI can provide to their data, also in the Device-\>VPN-\>visitorTraffic there is only a token issued by yourselves to provide authentication to both ends and no ability for customers to apply there own PKI systems. not utilising TLS anyway ---
**Author:** ![imrehg](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/imrehg/32/36_2.png) [@imrehg](https://forums.balena.io/u/imrehg)\ **Post date:** [May 24, 2017, 2:35pm UTC](https://forums.balena.io/t/open-https-via-public-url/994/6 "2017-05-24T14:35:32Z")
Was just checking it out, in my quick test actually serving HTTPS on port 80 does not seem to work with Public Device URL (while in general it works, could serve it on the local network). So that workaround is probably out, then 😕 If you’d like a tunnel that is completely independent of [resin.io](http://resin.io), then maybe can recommend [ngrok](https://ngrok.com/). That’s a pretty good service that we are using for a bunch of times here and there (not in the platform itself, but for projects). That way you can create your own separate communication channel, and seeing their docs, there seems to be a couple of settings that are relevant to how to do a setup as you mention. ---
**Author:** ![nite](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/nite/32/245_2.png) [@nite](https://forums.balena.io/u/nite)\ **Post date:** [May 24, 2017, 3:03pm UTC](https://forums.balena.io/t/open-https-via-public-url/994/7 "2017-05-24T15:03:24Z")
cheers @imrehg - we are indeed serving via node/express currently - will give https over port 80 a go. Cheers for the reminder re: ngrok - it’s definitely a handy service 🙂 ---
**Author:** ![jmarshall](https://avatars.discourse-cdn.com/v4/letter/j/7993a0/32.png) [@jmarshall](https://forums.balena.io/u/jmarshall)\ **Post date:** [May 24, 2017, 3:05pm UTC](https://forums.balena.io/t/open-https-via-public-url/994/8 "2017-05-24T15:05:58Z")
I had a look at ngrok the other day and thought nah won’t need that with resin’s public url 🤔 looks like i might need to have a chat with them then ---
**Author:** ![imrehg](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/imrehg/32/36_2.png) [@imrehg](https://forums.balena.io/u/imrehg)\ **Post date:** [May 24, 2017, 3:15pm UTC](https://forums.balena.io/t/open-https-via-public-url/994/9 "2017-05-24T15:15:40Z")
It all depends on what you want to achieve, always a trade-off ⚖ If your trust model is such that you trust [resin.io](http://resin.io) for device updates and management but not data traffic, then you’ll need some external services at the moment. Nevertheless, I’ll put in a note for the team to check out whether the Public URL can be served such as you describe it, thanks for the feedback! ---
**Author:** ![jmarshall](https://avatars.discourse-cdn.com/v4/letter/j/7993a0/32.png) [@jmarshall](https://forums.balena.io/u/jmarshall)\ **Post date:** [May 24, 2017, 3:28pm UTC](https://forums.balena.io/t/open-https-via-public-url/994/10 "2017-05-24T15:28:11Z")
no problem thanks for the help, hopefully this means we don’t move over to ngrok link 😳 as that could meet some of our device management needs too, are you likely to be getting ISO27001 any time soon? or be able to share how the VPN public URL coupling is handled? it doesn’t seem very graceful to use both at the same time but that said it would likely work very nicely ---
**Author:** ![CameronDiver](https://avatars.discourse-cdn.com/v4/letter/c/2acd7d/32.png) [@CameronDiver](https://forums.balena.io/u/CameronDiver)\ **Post date:** [May 24, 2017, 8:16pm UTC](https://forums.balena.io/t/open-https-via-public-url/994/11 "2017-05-24T20:16:36Z")
It’s a setup such that the connections go as Device \<-\> VPN \<-\> Proxy \<-\> Client. The VPN is OpenVPN through which the device communicates with the [resin.io](http://resin.io) services. The proxy is a very small app running on our servers based on [https://github.com/findhit/proxywrap](https://github.com/findhit/proxywrap), and it’s a really minimal wrapper to proxy data between the VPN and the client, and display some meaningful error messages when that’s not possible (ie. nothing’s listening on the device on port 80). As for ISO27001, I don’t think that it is something that we are currently working on. ---
**Author:** ![datashaman](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/datashaman/32/396_2.png) [@datashaman](https://forums.balena.io/u/datashaman)\ **Post date:** [May 25, 2017, 7:11pm UTC](https://forums.balena.io/t/open-https-via-public-url/994/12 "2017-05-25T19:11:02Z")
HTTPS over port 80 is a bad idea. Don’t mess with standards. Any number of things could go wrong with assumptions made about correspondence between port number and functionality with every piece of software used in the process. Any other port, just not 80. ---
**Author:** ![fcasarsa](https://avatars.discourse-cdn.com/v4/letter/f/e56c9b/32.png) [@fcasarsa](https://forums.balena.io/u/fcasarsa)\ **Post date:** [June 11, 2020, 8:25am UTC](https://forums.balena.io/t/open-https-via-public-url/994/13 "2020-06-11T08:25:55Z")
Hi All, sorry for resuming this old topic but for security reasons is a requirement for us that public URL traffic must be encrypted. Traffic between balena proxy and host could be unencrypted because it should be already protected by the vpn but internet traffic not. Balena proxy should enforce HTTPS. As a workaround we upgrade the connection from the js page to https but this still leaves our API exposed on internet over plain HTTP. Bye. ---
**Author:** ![AlidaOdendaal](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/alidaodendaal/32/1641_2.png) [@AlidaOdendaal](https://forums.balena.io/u/AlidaOdendaal)\ **Post date:** [June 11, 2020, 12:16pm UTC](https://forums.balena.io/t/open-https-via-public-url/994/15 "2020-06-11T12:16:02Z")
Hi @fcasarsa Thanks for your message. Can you please provide us with some more details on your use case, and how we can assist you in this? Kind regards Alida