Sites With an HTTPS Console

A site carries out what the Hub sends it by replaying each request to its own console, on the same machine (127.0.0.1, on the console's port). Every request that arrives over the site's tunnel is handled this way: proxied console pages, console sign-in through the Hub, job steps and AI calls through the Hub.

How the Site Replays Over HTTPS

When the site's console runs on HTTPS (qie.secureConsole is on; see Securing the QIE Web Console (HTTPS)), the site replays the Hub's requests over HTTPS too. Nothing has to be set at the Hub, and nothing beyond the console's own options at the site.

The site trusts exactly the certificates of the key entries in the keystore named by qie.consoleKeyStore, opened with qie.consoleKeyStorePass: the certificates the console itself serves. Any other certificate is refused, whoever signed it. The replay goes to 127.0.0.1, which the console's certificate does not name, so the site does not check the host name.

When the Keystore Cannot Be Used

If qie.consoleKeyStore is not set, the keystore cannot be read, or it holds no key entry with a certificate, the site cannot replay over HTTPS. It answers each request the Hub forwards with HTTP 502 and writes the reason to its log. In the browser, a site opened through the Hub shows the 502 error instead of the console.

Check the site's three console options, and that the site's own console opens over HTTPS, then try again.