Shinydocs Pro
Shinydocs Pro
Breadcrumbs

Setting up Shinydocs Control Center for Internal Access

Requirements

  • You must use an https connection.

  • If you are using a DNS name (FQDN) for the URL, you must create an A record in your DNS. CNAME will not work with Kerberos using Negotiate authentication for Shinydocs Pro Control Center.

  • When generating your .pfx file, you must include the full certificate chain. This means the .pfx should contain your server (leaf) certificate, any intermediate certificate(s) from your Certificate Authority, and the private key. If the intermediate certificates are not included, browsers may report the connection as insecure or claim the site has no certificate, even though one is installed.

    • If your .pfx does not contain any intermediate certificate(s), manually adding them to the Windows certificate manager may be required.

You can check the contents of your .pfx file using PowerShell:

$pfx = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection
$pfx.Import("C:\path\to\yourcert.pfx", "yourpassword", "PersistKeySet")
$pfx | Format-List Subject, Issuer

You should see at least two certificates listed: your server certificate and the intermediate certificate from your CA. If you only see one, the intermediates are missing and the .pfx needs to be rebuilt.

Configure Control Center to allow connections outside of localhost

By default, Shinydocs Control Center is only reachable on localhost. To make it available to others on your network, change the Server settings.

  1. In Control Center, go to Settings > Server.

  2. Turn on Enable custom URL, and in URL enter the full address users will use, for example https://hostname:9701.

  3. Under Certificate source, choose where the certificate comes from:

    • Upload a certificate file: select the .pfx or .p12 file under Certificate, and enter its Password if it has one. Turn on Self-signed certificate if the certificate is self-signed.

      cc-set-26-5-server-upload.png

    • Choose from the Windows certificate store: pick the Store location (Local machine or Current user), the Store (for example Personal or Web hosting) and the Certificate. Use this for certificates that renew automatically, such as Let’s Encrypt through win-acme: renewals need no manual step in Control Center.

      cc-set-26-5-server-store.png

  4. In Additional allowed hosts, list every host name users will type to reach Control Center, separated by semicolons and without spaces, for example servername.local;192.168.1.100;cc.yourcompany.com. localhost and the host in your URL are added automatically. Wildcards (*) are allowed; * on its own allows every host.

  5. Select Save changes. Control Center restarts, and access is briefly interrupted. Changing hosts can affect sign-in through Negotiate (Kerberos) or OIDC, so check that sign-in still works afterwards.

If you use a self-signed certificate, browsers show a warning that the site is not safe, because the certificate isn’t trusted by your computer or browser by default.