---
title: HTTP Proxy SSL/TLS Mode
slug: kronpam-reference-guide-3-9-0/http-proxy-ssltls-mode
description: This document provides guidance on securing Kron PAM communication by enabling HTTPS and logging all interactions. It highlights the risk involved in default HTTP authentication and suggests configuring the HTTP Proxy to use HTTPS to mitigate this threat.
docTags: 
createdAt: 2022-07-28T10:36:21.000Z
---

Secure HTTP (HTTPS) is already supported in Kron PAM. Configurations are the same for both HTTP and HTTPS. All HTTP requests, responses, headers, and contents sent and received during the session are logged.

Although Kron PAM secures all communication after authentication through HTTPS protocol, web browsers' default protocol for authentication is HTTP. Unencrypted data can be obtained if the network traffic is captured. To eliminate this risk, the HTTP Proxy can be configured to use the HTTPS protocol, even for proxy authentication.

To enable SSL on the HTTP Proxy, the **http.proxy.ssl.enabled **parameter should be set as **true **and the **http.proxy.protocol **parameter should be changed from **HTTP **to **HTTPS.** These parameters are located in **/u01/http proxy/conf/http\_proxy.properties**. It should be noted that **http.proxy.ssl.enabled** is used together with the** http.proxy.host **parameter - meaning that if the** http.proxy.ssl.enabled** parameter is set to true, the HTTP Proxy generates a certificate at runtime containing the given host as the Subject Alternative Name to ensure it is trusted by the browser. Otherwise, the browser will reject requests. Therefore, to configure HTTP Proxy settings on the browser or OS, the **http.proxy.host **parameter must be the same as the given host/IP.

To use this feature, the web browser must be started with the HTTPS protocol for authentication. For Chrome, it must be started as follows in the end-user browser to start the session with SSL:

chrome --proxy-server=https\://HTTP\_PROXY\_HOST:7080

:::hint{type="info"}
As shown in the Chrome browser example, end-users must open other browsers differently. Since this feature affects the end-user experience, it must be configured carefully.
:::