How to install SSL certificate in Odoo 11

Odoo by default transmits the information unencrypted, including the authentication.

That is why we consider that a secure Odoo deployment must have HTTPS, which requires SSL certificates that we will tell you how to configure and install below.

To carry out this procedure, it is required to:

SSL certificates (.pem and .key files) corresponding to the same domain through which your Odoo will be accessed.
SSH credentials of the "root" user to your Cloud Odoo, which you received by email at the time of hiring.

If you don't have an SSL certificate yet, you can create one now at:

SW Panel > Domains and SSL (left menu) > SSL Certificate Portfolio > Create SSL

For more information, see the following manual

SSL certificate installation in Odoo 11

Connect to your Cloud Odoo via SSH as "root" user.
Copy the .pem file of your SSL certificate in the directory:

/etc/ssl/

Copy the .key file of your SSL certificate in the directory:

/etc/ssl/private/

In this example, we have the following:

/etc/ssl/swhosting.com.pem

/etc/ssl/private/swhosting.com.key

Launch these commands to make a backup copy of the configuration files that we are going to modify:

cp -p /etc/odoo/odoo.conf /etc/odoo/odoo.conf.backup

cp -p /etc/nginx/sites-enabled/odoo.conf /etc/nginx/sites-available/odoo.conf.backup

Edit the following file:

/etc/odoo/odoo.conf

Add the following line:

proxy_mode = True

Outcome:

[options]
; This is the password that allows database operations:
; admin_passwd = admin
db_host = False
db_port = False
db_user = odoo
db_password = False
;addons_path = /usr/lib/python3/dist-packages/odoo/addons
proxy_mode = True

Edit the following file:

/etc/nginx/sites-enabled/odoo.conf

Replace all its content with the following:

#odoo server
upstream odoo {
 server 127.0.0.1:8069;
}
upstream odoochat {
 server 127.0.0.1:8072;
}

# http -> https
server {
   listen 80;
   server_name odoo.mycompany.com;
   rewrite ^(.*) https://$host$1 permanent;
}

server {
 listen 443;
 server_name odoo.mycompany.com;
 proxy_read_timeout 720s;
 proxy_connect_timeout 720s;
 proxy_send_timeout 720s;

 # Add Headers for odoo proxy mode
 proxy_set_header X-Forwarded-Host $host;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;
 proxy_set_header X-Real-IP $remote_addr;

 # SSL parameters
 ssl on;
 ssl_certificate /etc/ssl/certificado.pem;
 ssl_certificate_key /etc/ssl/private/certificado.key;
 ssl_session_timeout 30m;
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
 ssl_prefer_server_ciphers on;

 # log
 access_log /var/log/nginx/odoo.access.log;
 error_log /var/log/nginx/odoo.error.log;

 # Redirect longpoll requests to odoo longpolling port
 location /longpolling {
 proxy_pass http://odoochat;
 }

 # Redirect requests to odoo backend server
 location / {
   proxy_redirect off;
   proxy_pass http://odoo;
 }

 # common gzip
 gzip_types text/css text/less text/plain text/xml application/xml application/json application/javascript;
 gzip on;
}

Modify the following parameters of the previous file:

server_name odoo.mycompany.com;

It appears in duplicate. In both, replace “odoo.mycompany.com” with your domain. Example: "swhosting.com".

ssl_certificate /etc/ssl/certificado.pem;

Replace the path with the one corresponding to the .pem file of your SSL certificate.

ssl_certificate_key /etc/ssl/private/certificado.key;

Replace the path with the one corresponding to the key file of your SSL certificate.
As an example, the resulting configuration would be the following:

#odoo server
upstream odoo {
 server 127.0.0.1:8069;
}
upstream odoochat {
 server 127.0.0.1:8072;
}

# http -> https
server {
   listen 80;
   server_name swhosting.com;
   rewrite ^(.*) https://$host$1 permanent;
}

server {
 listen 443;
 server_name swhosting.com;
 proxy_read_timeout 720s;
 proxy_connect_timeout 720s;
 proxy_send_timeout 720s;

 # Add Headers for odoo proxy mode
 proxy_set_header X-Forwarded-Host $host;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;
 proxy_set_header X-Real-IP $remote_addr;

 # SSL parameters
 ssl on;
 ssl_certificate /etc/ssl/swhosting.com.pem;
 ssl_certificate_key /etc/ssl/private/swhosting.com.key;
 ssl_session_timeout 30m;
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
 ssl_prefer_server_ciphers on;

 # log
 access_log /var/log/nginx/odoo.access.log;
 error_log /var/log/nginx/odoo.error.log;

 # Redirect longpoll requests to odoo longpolling port
 location /longpolling {
 proxy_pass http://odoochat;
 }

 # Redirect requests to odoo backend server
 location / {
   proxy_redirect off;
   proxy_pass http://odoo;
 }

 # common gzip
 gzip_types text/css text/less text/plain text/xml application/xml application/json application/javascript;
 gzip on;
}

For the changes to take effect, restart the services involved:

systemctl restart nginx.service
systemctl restart odoo.service

Verify that you can access via HTTPS:

https://www.DominioOdoo.es

💡 Remember that the DNS zone of your domain must point to your Cloud Odoo. If you have not done it already, you must configure the same IP as your Cloud Odoo in the Registry.

If something went wrong, you need to restore the backup copies of the configuration files:

cp -p /etc/odoo/odoo.conf.backup /etc/odoo/odoo.conf

cp -p /etc/nginx/sites-available/odoo.conf.backup /etc/nginx/sites-available/odoo.conf

If everything went well, you can optionally delete the backup copies of the configuration files:

rm /etc/odoo/odoo.conf.backup

rm /etc/nginx/sites-available/odoo.conf.backup

Cookie name	Description	Type	Expiration
SERVERID	This cookie informs which is the server that has provided the answer to the request for browsing the web. This function is necessary for the functionality of the website.	HTTP	Session
swhosting_session	This feature is required for the functionality of the website, for example for the shopping cart.	HTTP	Session
XSRF-TOKEN	Ensures safe visitor browsing by preventing cross-site request forgery (CSRF). This cookie is essential for the security of the website and the visitor.	HTTP	1 day

Cookie name	Description	Type	Expiration
ss	Necessary for the functionality of the chat on the web.	HTTP	Session
TawkConnectionTime	Allows the web to recognize the visitor in order to optimize the chat function.	HTTP	Session

Cookie name	Description	Type	Expiration
_ga	Registers a unique identification that is used to generate statistical data about how the visitor uses the website.	HTTP	2 years
_gat	Used by Google Analytics to control the request rate	HTTP	1 day
_gid	Registers a unique identification that is used to generate statistical data about how the visitor uses the website.	HTTP	1 day

Cookie name	Description	Type	Expiration
_fbp	Used by Facebook to provide a series of advertising products, such as bids, in real time from third-party advertisers.	HTTP	3 months
_gcl_au	Used by Google AdSense to experiment with advertising efficiency across the web using its services.	HTTP	3 months
fr	Used by Facebook to provide a series of advertising products such as real-time bidding, from third-party advertisers.	HTTP	3 months

Guides and tutorials

Categories

How to install SSL certificate in Odoo 11

SSL certificate installation in Odoo 11

Categories

Your privacy is important for us

Your privacy is important for us