Serve Lantern over HTTPS

By default Lantern listens on 127.0.0.1:8000: plain HTTP, reachable only from the collector machine. To use it from other computers, serve it over HTTPS.

#1. Get a certificate

Use a certificate your browsers already trust: from your internal certificate authority (Active Directory Certificate Services, for example) or a public one. It must include the name people will type, such as lantern.northwind.local, as a subject alternative name. Lantern needs two PEM files: the certificate (with any intermediates after it) and the private key.

#2. Start Lantern with it

On Windows:

powershell -ExecutionPolicy Bypass -File .\install-service.ps1 -Address 0.0.0.0:8443 `
  -TlsCert C:\certs\lantern.crt -TlsKey C:\certs\lantern.key -Hosts lantern.northwind.local -OpenFirewall

On Linux:

sudo ./install.sh --addr 0.0.0.0:8443 --tls-cert /etc/lantern/tls.crt --tls-key /etc/lantern/tls.key --hosts lantern.northwind.local

Or directly: netmap -addr 0.0.0.0:8443 -tls-cert lantern.crt -tls-key lantern.key -hosts lantern.northwind.local.

#3. Tell Lantern its address

In Settings › Sign-in, set Public address to https://lantern.northwind.local:8443. Lantern uses it to build the redirect URI for cloud sign-in.

#Why the host name matters

Lantern answers only to IP addresses, localhost and the names listed with -hosts. This blocks DNS rebinding, where a malicious web page points its own name at your collector to reach it through a technician's browser. If a browser shows unknown host name; add it with -hosts, add the name you are using.

#Behind a reverse proxy

You can also put Lantern behind a TLS-terminating reverse proxy on the same machine (Lantern still listens on 127.0.0.1). Set Public address to the proxy's HTTPS address and add its name with -hosts. Lantern requires changes to come from its own pages (same origin, JSON requests), so the proxy must pass the Host and Origin headers through unchanged.