# Enable network encryption (TLS) in BRIX On-Premises

> [HTML Version](enable-tls-enterprise.html)

BRIX On-Premises supports Transport Layer Security (TLS) 1.2+ for incoming and outgoing traffic. To automatically switch the application to work over the secure HTTPS protocol, enable TLS encryption support.

Enabling TLS for the BRIX application consists of three stages:

1. [Prepare a secret with a certificate for working via HTTPS](#preparation-of-secret-for-work-on-https).

2. [Make changes to the configuration file](#change-config-file).

3. [Apply TLS parameters for BRIX On-Premises](#using-tls-for-elma365-enterprise).

## Step 1: Prepare a secret with a certificate for working via HTTPS

To work over the HTTPS protocol, create a secret with a certificate. Next, configure trust support if it is required by the certificate or set of CA certificates you are using. Read more about these actions in [Create a secret with a certificate for HTTPS operation](preparation-secret-with-certificate-https.md).

## Step 2: Make changes to the configuration file values-brix365.yaml

````
Начало внимание

````
Before editing the \[OBJECT\] file, make a backup copy of it, as incorrect parameter settings may cause BRIX application malfunction.

````
Конец внимание

1. ````
Fill put the configuration file \[OBJECT\] to enable TLS.

To enable encryption support, specify \[OBJECT\] in the parameter \[OBJECT\]. In this parameter, specify the name of the certificate for working via \[OBJECT\], for example, \[OBJECT\]. The certificate must be issued for the domain name FQDN in the parameter \[OBJECT\], through which the system will be accessible, for example \[OBJECT\].

````
global:  
  ## Domain (FQDN) or ip address where the system is available  
  host: 'example.com'  
  ingress:  
  ## Enable host in ingress (value taken from host)  
  ## For installed s3 minio via brix365-dbs charts, specify in the minio block  
  ## the value in the hosts parameter in the values-dbs.yaml file  
  hostEnabled: false  
  onpremiseTls:  
    ## enable HTTPS  
    enabled: true  
    ## name of the secret with certificates for HTTPS  
    secret: "brix365-onpremise-tls"

Начало внимание

````
Before applying TLS parameters for the BRIX application, ensure that the S3 file storage operates over the HTTPS protocol (uses TLS encryption).

````
Конец внимание

2. ````
Specify in the connection parameters that the S3 storage server uses TLS encryption. To do this, set \[OBJECT\] in the \[OBJECT\] parameter.

````
...  
db:  
  ...    
  ## connections settings for S3 file storage  
  s3:  
    method: PUT  
    accesskeyid: PZSF73JG72Ksd955JKU1HIA  
    secretaccesskey: aFDkj28Jbs2JKbnvJH678MNwiz88zKjsuNBHHs  
    bucket: s3brix365  
    backend:  
      address: example.com  
      region: us-east-1  
    ssl:  
      enabled: "true"  
...

## ````
Step 3: Apply TLS parameters for BRIX On-Premises

You can update parameters for BRIX On-Premises in two ways: online and [offline](#update-offline).

### Update parameters online

1. Determine the chart version with which the BRIX application was installed or updated:

````
helm show chart brix365/brix365

````
Example of command execution:

**[![enable-tls-enterprise-1](enable-tls-enterprise-1.png)]**

After the command execution, you see the chart version information in the \[OBJECT\] string. Save this value for the next step.

2. Update the parameters using the \[OBJECT\] configuration file. To do this, execute the following command specifying the installed chart version for the \[OBJECT\] flag instead of \[OBJECT\]:

````
helm upgrade --install brix365 brix365/brix365 -f values-brix365.yaml --version <brix365-chart-version> --timeout=30m --wait \[-n namespace\]

### ````
Update parameters offline

Navigate to the directory with the downloaded BRIX chart and execute the command:

````
helm upgrade --install brix365 ./brix365 -f values-brix365.yaml --timeout=30m --wait \[-n namespace\]

````
It takes about 10-30 minutes to update the parameters. Wait for it to complete.