Configuring TLS Certificates

By default, IO Libraries Suite (IOLS) uses self-signed TLS certificates for its web-based services (HTTPS/WSS). As a result, web browsers may display security warnings when you access applications such as Connection Expert.

To avoid these warnings, you can configure IOLS to use a trusted TLS certificate.

Prerequisites

To complete this procedure, you must have:

  • A TLS certificate file (.pem)—a certificate that is trusted by your operating system or browser.
  • The matching private key file (.pem)

The certificate can be:

  • Issued by your organization’s internal Certificate Authority (CA), or
  • A self-signed certificate that you manually trust on your system

If you do not use a trusted certificate, browser security warnings cannot be avoided.

Step 1: Obtain a TLS Certificate and Private Key

Option 1: Use a company-issued certificate

Contact your IT or security team and request:

  • A TLS certificate for the system running IOLS
  • Certificate format: PEM
  • Usage: HTTPS / WSS

Your IT team should provide:

  • A certificate file (cert.pem)
  • A private key file (key.pem)

Option 2: Generate your own trusted certificate

You may generate a certificate, sign it with a CA, and then import it into your OS or browser trust store.

Step 2: Locate the IOLS TLS Configuration File

The TLS configuration file is shared by all IOLS components.

Copy
Linux
/etc/keysight/iolibs/tls.yaml
  • If the file does not exist, create it.

  • Use absolute file paths

  • Ensure both files are in PEM format

  • Ensure the certificate and key match

Step 3: Configure the tls.yaml File as Follows

Copy

tls.yaml

tls:
  key:
    path: "C:/my/key.pem"   # PEM-based private key file
  cert:
    path: "C:/my/cert.pem"  # PEM-based certificate file

Step 4: Save the File

  • Save the file as tls.yaml
  • Use UTF-8 encoding
  • Do not use tabs (use spaces only)

Step 5: Restart the System

After updating the TLS configuration, restart the system to apply the changes.

Changes to the TLS configuration do not take effect until after a restart.

Step 6: Verify the Configuration

After restart:

  • Open a browser
  • Access Connection Expert or other IOLS web-based services
  • Confirm that browser security warnings no longer appear

If warnings persist:

  • Verify the certificate is trusted by the OS or browser
  • Verify file paths in tls.yaml
  • Confirm the certificate and private key match

What Happens If No Configuration Is Provided

If tls.yaml is missing, empty, or invalid:

  • IOLS automatically generates a self-signed certificate
  • Browser security warnings will continue to appear