# SSL certificate update for https connection

**URL:** <https://datashield.discourse.group/t/ssl-certificate-update-for-https-connection/483>\
**Category:** Analyst Support\
**Created:** [6 December 2021 09:34 UTC](https://datashield.discourse.group/t/ssl-certificate-update-for-https-connection/483 "2021-12-06T09:34:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sztop](https://avatars.discourse-cdn.com/v4/letter/s/22d042/32.png) [@sztop](https://datashield.discourse.group/u/sztop)\
**Post date:** [6 December 2021 09:34 UTC](https://datashield.discourse.group/t/ssl-certificate-update-for-https-connection/483/1 "2021-12-06T09:34:32Z")

</div>

Hello, I have a Datashield instance in the docker container and I am trying to connect to opal using https as follows:`o <- opal.login("administrator", "password", url="https://datashield-opal:8443"`

I got an error message:

```auto
SSL: certificate subject name (localhost) does not match target host name 'datashield-opal'

```

I added a new certificate using the opal UI but after downloading the certificate from the opal url it looks like it has not been updated:

```auto
echo -n | openssl s_client -showcerts -connect datashield-opal:8443 -servername datashield-opal \
 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/, /-END CERTIFICATE-/p' \
 >> cert.crt

```

and then

```auto
openssl req -x509 -noout -serial -subject -in cert.crt

```

returns:

```auto
subject=CN = localhost, OU = Opal, O = localhost, L =, ST =, C =

```

Any ideas on how to handle the certificate in a containers environment where default certificate is not working?

---

<div class="post-metadata">

**Author:** ![yannick](https://yyz2.discourse-cdn.com/free1/user_avatar/datashield.discourse.group/yannick/32/19_2.png) [@yannick](https://datashield.discourse.group/u/yannick)\
**Post date:** [7 December 2021 11:16 UTC](https://datashield.discourse.group/t/ssl-certificate-update-for-https-connection/483/2 "2021-12-07T11:16:49Z")

</div>

Hi,

Use a reverse proxy to access opal (whether in a docker container or not). It will be much simpler to manage certificates, security headers, ssl cipher suite etc. See example in documentation: [https://opaldoc.obiba.org/en/latest/admin/configuration.html#reverse-proxy-configuration](https://opaldoc.obiba.org/en/latest/admin/configuration.html#reverse-proxy-configuration)

Regards  
Yannick