Skip to main content

Change the MagicINFO HTTPS (TLS) Certificate

MagicINFO Server serves HTTPS through its built-in Tomcat web server. The certificate, its password and the allowed TLS versions are set on one element, the HTTPS Connector in server.xml, which listens on port 7002 by default. This page covers three jobs: replacing the certificate, turning HTTPS on after an HTTP-only install, and switching the server to HTTPS only.

All three follow the same pattern: stop the service, edit one file, start the service, test.

Before you start​

  • Get a certificate the displays and browsers will trust. Use one from a public certificate authority, issued for the name people and displays use to reach the server (for example magicinfo.example.com). Recent display firmware can verify the server certificate; when that check is on, a self-signed or otherwise untrusted certificate makes the display fail to connect, with no clear message on screen.
  • Put it in a keystore with the full chain. Tomcat reads a Java keystore: JKS, or PKCS12 (a .p12 or .pfx file). The keystore must contain the private key, your certificate and the intermediate certificates of the authority. A keystore without the intermediates works in some browsers and fails on displays and other clients.
  • Choose your own keystore password. Never keep the default passphrase from a fresh install.
  • Back up server.xml. Copy C:\MagicInfo Premium\tomcat\conf\server.xml to a safe place. If the server does not come back after your change, restoring this copy undoes it.
  • Plan for downtime. After a restart the web console and the displays need several minutes before the server answers again.

Turning a .pfx export into a keystore​

A certificate exported from Windows as a .pfx file is already a PKCS12 keystore, and Tomcat can usually read it as it is (with keystoreType="PKCS12"). If you prefer a clean copy under a new name, the standard Java keytool converts it:

keytool -importkeystore -srckeystore cert.pfx -srcstoretype PKCS12 -destkeystore magicinfo.p12 -deststoretype PKCS12

When asked, enter the password you chose when exporting the .pfx as the source password. To check that the chain is complete, list the keystore and look at the certificate chain length (it should be more than 1 for a certificate from a public authority):

keytool -list -v -keystore magicinfo.p12 -storetype PKCS12

Place the keystore in C:\MagicInfo Premium\runtime\keystore\, next to the one the installer created.

Stop and start the service​

  1. Press Windows + R, type services.msc and press Enter.
  2. Find MagicInfo-i Premium Edition Server and click Stop.
  3. Make your change (one of the sections below).
  4. Select the same service and click Start, then wait several minutes before testing.

Replace the certificate​

  1. Stop the service.
  2. Open C:\MagicInfo Premium\tomcat\conf\server.xml in a text editor.
  3. Find the <Connector port="7002" …> element. Leave the rest of the file alone.
  4. Change three attributes:
    • keystoreFile: the path to your keystore, written with forward slashes.
    • keystorePass: your keystore password.
    • keystoreType: PKCS12 for a .p12 / .pfx file, JKS for a .jks file.
  5. While you are there, set sslEnabledProtocols="TLSv1.2,TLSv1.3". Older connectors also allow TLS 1.0, TLS 1.1 and SSLv2Hello; remove them.
  6. Save the file and start the service.

The connector should look like this afterwards (shown on several lines for readability; one line works the same):

<Connector port="7002"
    protocol="org.apache.coyote.http11.Http11Nio2Protocol"
    maxHttpHeaderSize="8192" maxThreads="150" enableLookups="false"
    disableUploadTimeout="true" acceptCount="100"
    scheme="https" secure="true" SSLEnabled="true"
    keystoreFile="C:/MagicInfo Premium/runtime/keystore/magicinfo.p12"
    keystorePass="YOUR-KEYSTORE-PASSWORD"
    keystoreType="PKCS12"
    URIEncoding="UTF-8" sslProtocol="TLS"
    sslEnabledProtocols="TLSv1.2,TLSv1.3"
    maxPostSize="8388608" />

Tomcat uses the keystore password for the private key as well, so the key and the keystore should share the same password.

Turn on HTTPS after an HTTP-only install​

If you chose HTTP during installation, server.xml has a connector on port 7001 and none for HTTPS.

  1. Stop the service and back up server.xml.
  2. Find the <Connector port="7001" …> element.
  3. Directly below it, add the HTTPS connector shown in Replace the certificate, with your own keystore path, password and type.
  4. Save, start the service and test.

Both ports now answer: 7001 for HTTP and 7002 for HTTPS. Displays keep working on whichever they were set to; move them to HTTPS one by one by switching TLS on in their server settings and changing the port to 7002 (or 443 behind a proxy).

Use HTTPS only​

  1. First move every display to HTTPS. A display still set to port 7001 loses its connection the moment the HTTP connector is gone.
  2. Stop the service and back up server.xml.
  3. Make sure the 7002 HTTPS connector is present and working.
  4. Remove the <Connector port="7001" …> element. Turning it into an XML comment (<!-- … -->) instead of deleting it makes it easy to bring back.
  5. Save, start the service and test.

If your server was installed on other ports than 7001 and 7002, use your ports in place of these throughout.

Test the result​

  1. Open https://<server>:7002/MagicInfo/ with the name the certificate was issued for. The browser should show the page without a warning. Opening it with localhost or an IP address gives a name-mismatch warning even with a good certificate.
  2. Inspect the certificate in the browser: check the name, the expiry date and that the chain ends at a trusted authority.
  3. Open https://<server>:7002/MagicInfo/openapi/auth?cmd=isMagicInfo. This is the first request a display makes; a short version number means MagicINFO answers on HTTPS.
  4. On a display, set the server address, turn TLS on (SSL in older menus) and enter the HTTPS port. TLS setting and port must match; see MagicINFO ports explained.

Common problems​

The service does not come back after the change. Usually a typo in server.xml, a wrong keystore path, a wrong password or the wrong keystoreType. Compare with your backup, or restore it to get the server running again, then retry.

Browsers accept the certificate but displays do not connect. Check that the keystore contains the intermediate certificates, that the certificate name matches the address set on the display, and that the display's clock is correct; a display with a wrong date sees a valid certificate as expired or not yet valid. See Setting the device time and date.

"This site can't be reached" on the http:// address after enabling HTTPS. MagicINFO sends browsers an HSTS header that tells them to use HTTPS only, for a year, for that name and its subdomains. Once a browser has opened the server over HTTPS, it refuses the plain HTTP address, while other tools still connect. Use the https:// address consistently. To undo it in one browser, delete the stored policy for that name at chrome://net-internals/#hsts (edge://net-internals/#hsts in Edge). Displays are not affected.

HTTPS stopped answering after adding TLS 1.3 on an older build. Older builds ship an older Java runtime. Set sslEnabledProtocols="TLSv1.2" and test again; TLS 1.2 on its own is still a sound setting.

The certificate expires. Renew it with the authority, build a new keystore and repeat Replace the certificate. Put the expiry date in your calendar.

A MagicINFO upgrade put the old settings back. An upgrade can replace files in the installation folder. Check the HTTPS connector in server.xml after every upgrade and keep a copy of your edited version.

Version notes​

  • Builds from 21.1070 can run the HTTPS connector with a PKCS12 keystore and TLSv1.2,TLSv1.3.
  • Build 21.1092.3 ships Tomcat 9.0.115, per Samsung's release notes. For the Tomcat and Java versions of older releases, see Tomcat and Java Versions in Older Releases.

Checked against MagicINFO Server 9 on Windows (builds 21.1070 to 21.1092.3), October 2026.

Last updated on