By default, Portainer’s web interface and API is exposed over HTTPS with a self-signed certificate generated by the installation. This can be replaced with your own SSL certificate either after installation or during installation, as explained in this article.
When using your own externally-issued certificate, ensure that you include the full certificate chain (including any intermediate certificates) in the file you provide via --sslcert. Without this you may face certificate validation issues. Your certificate chain can be obtained either from your certificate issuer or the What's My Chain Cert? website.
Using your own SSL certificate on Docker Standalone
Portainer expects certificates in PEM format.
Use the --sslcert and --sslkey flags during installation.
Upload your certificate (including the chain) and key to the server running Portainer, then start Portainer referencing them. The following command assumes your certificates are stored in /path/to/your/certs with the filenames portainer.crt and portainer.key, and bind-mounts the directory to /certs in the Portainer container:
Alternatively, Certbot can be used to generate a certificate and a key. Because Docker has issues with symlinks, if you use Certbot you will need to pass both the 'live' and 'archive' directories as volumes, as well as use the full chain certificate. For example:
When you're finished, you can navigate to https://$ip-docker-host:9443.
Using your own SSL certificate on Docker Swarm
To provide your own SSL certificate for Docker Swarm, simply define the portainer.sslcert and portainer.sslkey secrets, and the installation manifest will automatically detect and use them: