Mosart Web Apps communicates through a proxy server that must be configured. This page covers the proxy setup methods, and how HTTPS and certificates work across the Mosart network.

Proxy setup method

You can choose to use the onboard proxy bundled with Viz Mosart or an external proxy. Click either

  • Automatic proxy setup to use the onboard proxy server (Caddy v2), or

  • Manual proxy setup to use your own proxy server.

Automatic proxy setup

With the onboard proxy web server, configurations are automatically generated based on the settings displayed on the Server Configuration page, and all default settings are pre-filled. Selecting HTTPS automatically configures both the Mosart Web Applications and the Mosart Web Proxy (Caddy). You then choose how certificates are provided, either the built-in certificate authority or your own certificate.

Info: If the Mosart Web Proxy and the Mosart Web Applications are configured with HTTPS using your own certificate, you must also configure HTTPS for the Mosart servers (main and backup, if applicable). See Mosart servers over HTTPS below.

Manual proxy setup

You can use an external proxy server, but it must be manually configured. If the external proxy server is configured with HTTPS, you must also set up HTTPS for the Viz Mosart Web Applications and Mosart servers.

Tip: You can examine the Caddy file generated when Automatic proxy setup is selected to understand how to set up an external proxy. This Caddy file resides at C:\ProgramData\Mosart Medialab\Mosart Web Apps.

  1. From the Server Configuration page, select Manual proxy setup.

  2. Under section PROXY WEB SERVER in field URL, enter the URL address to the external proxy server. This must be a valid web URL starting with http or https.

  3. Select the HTTPS check-box and follow the onscreen guidelines.

  4. Web Server Address: The IP or the hostname of the Viz Mosart web server. The system attempts an auto-detect. If the FQDN is required (for example, by a certificate), provide this instead.

  5. Certificate file: The certificate in encrypted PEM format. If FQDN is specified in the certificate file, the Mosart web server address must also be a FQDN.

  6. Click Save.

Certificates

With HTTPS enabled under the automatic proxy setup, the Certificates setting offers two approaches.

Automatic (built-in CA)

The bundled Mosart Web Proxy contains its own certificate authority. Choose Automatic (built-in CA) and the proxy mints the certificates it needs itself, the first time it starts. There is no certificate file to obtain, install or renew.

Because the certificates are issued by a private authority, browsers do not trust them until you say so. The tool therefore exposes the authority's Root certificate, with an Open folder action that reveals it on disk. Distribute that root certificate to the machines that will use the Web Apps and install it as a trusted root, and the warnings stop.

Note: The root certificate is only created once the web proxy has started, so save the configuration first. Until then the tool reports that it has not been generated yet.

With the built-in CA, the proxy terminates HTTPS for the browser and talks plain HTTP to everything behind it: the Mosart Web Apps server and the Viz Mosart servers, including when those run on other machines. Browser traffic is encrypted; the traffic from the proxy onwards is not.

This is also why the built-in CA is only available with the automatic proxy setup, since it lives inside the bundled proxy and cannot serve a manual, external proxy, and why the Authentication section requires custom certificate mode.

Custom certificate

Choose this to supply your own certificate, which is what you need when your organization issues certificates centrally, when the same certificate must cover several Mosart components, or when you want to enable Authentication. Provide the certificate file, the private key file and the key password.

For the Mosart Web Proxy, the configured private key is used to automatically generate the unencrypted PEM format that Caddy requires, which is saved in C:\ProgramData\Mosart Medialab\Mosart Web Apps.

Which mode to choose

Choose

When

Automatic (built-in CA)

You want browser traffic encrypted quickly, with no certificates to obtain or renew. You accept installing the authority's root certificate on each client machine, and that traffic between the proxy and the servers behind it stays unencrypted. User sign-in is not available in this mode.

Custom certificate

You want user sign-in (OIDC), or you want the traffic to the Mosart Web Apps server and the Viz Mosart servers encrypted as well. Also the natural choice when your organization already issues certificates, since client machines then trust them without further steps.

Certificate requirements

The requirements below apply when you supply your own certificate. With the built-in CA, the proxy handles all of this itself and you only have to distribute its root certificate.

  • Type: X.509 certificates.

  • Format: PEM-encoded certificates and private keys. For the Mosart Web Proxy (Caddy), the key must be in unencrypted PEM format, which is automatically generated by Mosart from the provided encrypted key file.

  • Encryption: Private keys must be encrypted and provided with the corresponding password. You can verify that the key is encrypted by opening it in an editor and checking that it starts with "-----BEGIN ENCRYPTED PRIVATE KEY-----".

  • Host coverage: The certificate must include the host where the Mosart Web Applications are installed. The hosts provided in the Mosart Web Config tool are validated against the certificate (case sensitive). If the hosts in the certificate are the Fully Qualified Domain Name (FQDN), then the hosts provided in the Mosart Web Config Tool must be the FQDN as well. If the same certificate and key files are used across all Mosart components (Mosart web server, Mosart web proxy, Mosart server main, Mosart server backup), the certificate must specify all relevant hosts or their FQDNs.

Certificate installation

When Mosart Web Applications are configured with HTTPS, all communication between clients, proxy servers, and content servers must be secured: the Mosart web clients (Rundown Viewer, NRCS Plugin, Smart Panel, Showmaker), the Mosart web server, the proxy server, and the Mosart server (Mosart Remote Control Service).

Certificates must therefore be trusted on any machine where Mosart Web Apps are used. Ensure the certificates are installed on:

  • Mosart Web Applications / Mosart Web Proxy.

  • Any Mosart server.

  • Any machine running Mosart web clients.

If the certificate is not installed on a machine using a Mosart Web App, the browser will warn of an insecure connection, suggesting you proceed at your own risk. However, if the Mosart Web App is integrated as a plugin within other applications (for example, into ENPS), there may be no warning, and instead issues like pages displaying blank may be experienced.

Mosart servers over HTTPS

When the Web Apps run HTTPS with your own certificate, the Mosart servers (main and backup) must serve HTTPS too, so that rundown updates and commands between the Viz Mosart server and the web applications stay secured.

HTTPS on the Mosart server is configured in the Mosart settings under Remote Controller Service > Security, followed by a restart of the Mosart Remote Control Service on each server. The procedure is described in the Viz Mosart Administrator Guide, chapter Security in Viz Mosart Ecosystem, section Securing the Mosart Server.

Afterwards, confirm on the Studios page that the Mosart main and backup server ports read 55168.