A digital certificate is a signed data structure that binds an identity to a public key. In HTTPS, the web server shares the certificate while keeping its matching private key secret. The browser uses the certificate to assess the server connection before encrypted communication begins. section 16.4.1 section 16.4.2
A certificate participates in HTTPS through several related steps:
- The server returns a certificate containing a publicly sharable key. section 16.4.1
- The browser and server establish a session key; asymmetric encryption protects the exchange, while symmetric encryption protects subsequent traffic. section 16.4.1
- A certificate authority can provide the certificate, or an operator can create a self-signed certificate for local use. section 16.4.2
- Browsers generally trust certificates from recognized stores; self-signed certificates trigger warnings until explicitly trusted. section 16.4.2
Configure HTTPS for Airflow locally
Generate a self-signed certificate with OpenSSL, then point Airflow at the two files: `openssl req -x509 -newkey rsa:4096 -sha256 -nodes -days 365 -keyout privatekey.pem -out certificate.pem -extensions san -config <(echo "[req]"; echo distinguished_name=req; echo "[san]"; echo subjectAltName=DNS:localhost,IP:127.0.0.1) -subj "/CN=localhost"`. Configure `AIRFLOW__API__SSL_CERT=/path/to/certificate.pem` and `AIRFLOW__API__SSL_KEY=/path/to/privatekey.pem`. Airflow then serves the UI at `https://localhost:8080`; keep the private key secret and add the self-signed certificate to the local trust store if appropriate. section 16.4.2
