Generate certificates with the Pilot CLI and enable TLS between your load balancer and Somewear Core. This also unblocks bidirectional federated TAK integrations, which require TLS to be on.

What you’ll need

• Shell access to a Somewear Core host, with permission to switch to the pilot user
• The address of your TAK server, if you’re setting up federation (optional — you can leave this blank and add it later)

Generate TLS certificates

By default, TLS isn’t enabled for Somewear Core: HTTPS sessions terminate at the load balancer, and traffic between the load balancer and your application nodes travels unencrypted. Generating certificates and enabling TLS closes that gap.

1. Switch to the pilot user account:

   sudo su - pilot

2. Run the Pilot command to create TLS certificates:

   pilot node create-tls-certs

3. Answer the prompts. The command is interactive and asks for:

   • A short name/label for the certificate
   • A TAK federation address (optional — leave it blank if you’re not federating yet)

   Example run:

   $ pilot node create-tls-certs
   Generating TLS certificates for somewear.example.org
   Enter short name/description for the certificate: ACME
   Enter the TAK address for the certificate: tak.example.org
   TLS certificate generation complete.
   
   Enabling TLS in somewear.conf
   TLS configuration complete.  Restart the service to apply the changes.

Restart Somewear Core

Certificates and TLS configuration don’t take effect until the service restarts.

1. From the pilot user’s home directory, stop and restart Somewear Core:

   docker compose stop somewear-core
   docker compose up -d

2. Optionally, follow the startup logs to confirm the service comes back up clean:

   docker logs -f somewear-core

Note

For multi-instance installs, generate certificates on one host only. After they’re written to /home/pilot/certs, copy the contents from that directory to the same path on every other Somewear Core node before restarting the service on each.