Enable-ZrManagementHttps
Turns on control-plane HTTPS for the Management Service and Web Console — separate from cluster transport TLS — by persisting the opt-in and minting a CA-issued server certificate (or using one you supply).
Syntax
Enable-ZrManagementHttps
[-CertSource <string>]
[-CertPath <string>]
[-CertPassword <string>]
[-Restart]
[-Managers <string[]>] [-Port <int>] [-Token <string>] [-TimeoutSec <int>]
[-WhatIf] [-Confirm]
Description
Enable-ZrManagementHttps enables HTTPS for the management/console control plane. This is separate from cluster transport TLS (Enable-ZrStoreTls) — it secures the Management Service and Web Console endpoints, not node-to-node data traffic. It persists the opt-in marker on every connected manager and mints a server certificate.
-CertSource chooses the certificate: ca (the default) mints one from the cluster CA, or provided uses a supplied PFX — in which case -CertPath is required. A service restart activates the change: pass -Restart to restart the Management Service and Web Console automatically (requires an elevated shell), or restart them yourself afterward. Remote managers must restart their own services. Once active the management and console URLs become https://; import the CA with Get-ZrClusterCaCert to avoid browser warnings. Requires an active workspace or an explicit -Managers list.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
-CertSource | string | No | Source of the server certificate: ca (default) to mint one from the cluster CA, or provided to use a supplied PFX. |
-CertPath | string | No | Path to the PFX server certificate file; required when -CertSource is provided. |
-CertPassword | string | No | Password protecting the supplied PFX certificate file. |
-Restart | switch | No | Restarts the Management Service and Web Console so the HTTPS change activates immediately (requires an elevated shell). |
-Managers | string[] | No | Management Service endpoints to target; when omitted the active workspace's managers are used. |
-Port | int | No | Management Service port for bare-host managers. Default 7801. |
-Token | string | No | Admin bearer token for authenticated control-plane calls. |
-TimeoutSec | int | No | Per-request timeout in seconds. Default 30. |
Supports -WhatIf and -Confirm.
Examples
Enable control-plane HTTPS with a CA-issued server certificate and restart the services so the https:// endpoints activate.
Enable-ZrManagementHttps -Restart
Enable control-plane HTTPS using a server certificate you supply.
Enable-ZrManagementHttps -CertSource provided -CertPath server.pfx -CertPassword '<cert-password>' -Restart