When running Dolibarr ERP & CRM for your business, securing access to your system is just as important as the data it manages. Without proper encryption, sensitive business information such as customer data, financial transactions, and login credentials could be exposed to cyber threats. One of the most fundamental and effective ways to secure Dolibarr is to implement HTTPS with SSL certificates.

This comprehensive guide will walk you through why HTTPS is crucial, how SSL certificates work, and exactly how to secure your Dolibarr installation using industry-standard tools and best practices. We’ll also look at options for self-signed vs. trusted certificates, automation with Let's Encrypt, renewing certificates, and how to troubleshoot common issues.

Why HTTPS Matters for Dolibarr

Dolibarr handles sensitive data by design: from invoices and HR information to CRM records and inventory. If accessed over HTTP, this information can be intercepted by attackers through man-in-the-middle (MitM) attacks. HTTPS uses SSL/TLS to encrypt communication between the server and client, protecting your data in transit.

Benefits of HTTPS include:

• Encryption of all communications (including login credentials)

• Protection against eavesdropping and tampering

• Increased user trust and professional credibility

• Compliance with privacy regulations (like GDPR)

• Ability to use advanced features (e.g., secure cookies, HTTP/2)

Whether you access Dolibarr over a public IP, VPN, or locally via browser, HTTPS is no longer optional—it’s essential.

Understanding SSL/TLS and Certificates

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols that secure communications over a computer network. HTTPS is HTTP layered on top of SSL/TLS.

To enable HTTPS on a server, you need:

• A private key: Kept secret on your server

• A certificate: Public file proving your domain identity, issued by a Certificate Authority (CA)

Certificates come in several types:

• Self-signed: Created manually; useful for internal use, not trusted by browsers

• CA-signed: Issued by a public CA like Let’s Encrypt, Comodo, or DigiCert; trusted by all browsers

Let’s Encrypt offers free certificates that are widely accepted and easy to automate, making them ideal for SMEs.

Step-by-Step: Securing Dolibarr with HTTPS

1. Prerequisites

Make sure you have:

• A working Dolibarr installation (Apache or Nginx server)

• Root or sudo access to the server

• A public domain name pointing to your server IP

• SSH access for terminal configuration

2. Install Certbot for Let’s Encrypt

Let’s Encrypt uses Certbot to automate certificate issuance and renewal.

For Debian/Ubuntu:

sudo apt update
sudo apt install certbot python3-certbot-apache

Or for Nginx:

sudo apt install certbot python3-certbot-nginx

3. Request a Certificate

Assuming your domain points correctly to the server:

sudo certbot --apache -d yourdomain.com

Or with Nginx:

sudo certbot --nginx -d yourdomain.com

Certbot will:

• Verify domain ownership

• Obtain the SSL certificate

• Configure your web server for HTTPS automatically

• Create a renewal cron job

If using a firewall, allow HTTPS:

sudo ufw allow 'Apache Full'

4. Test HTTPS Access

Open your browser and go to:

https://yourdomain.com/dolibarr

You should see a padlock icon. Clicking it confirms that the connection is encrypted and the certificate is valid.

5. Configure Dolibarr for HTTPS

In some cases, Dolibarr may retain HTTP links. To enforce HTTPS:

• Open the conf/conf.php file in your Dolibarr installation

• Set the DOL_MAIN_URL_ROOT to use HTTPS:

$dolibarr_main_url_root='https://yourdomain.com/dolibarr';

• Clear your browser cache and cookies

6. Force HTTPS Redirect (Optional)

To ensure all HTTP traffic redirects to HTTPS:

Apache (in your VirtualHost config):

<VirtualHost *:80>
    ServerName yourdomain.com
    Redirect permanent / https://yourdomain.com/
</VirtualHost>

Nginx:

server {
    listen 80;
    server_name yourdomain.com;
    return 301 https://$host$request_uri;
}

Automating Renewal with Cron

Let’s Encrypt certificates expire every 90 days. Certbot usually installs a renewal cron job, but you can verify or add your own:

sudo crontab -e

Add:

0 3 * * * certbot renew --quiet

To test:

sudo certbot renew --dry-run

Using a Self-Signed Certificate (Advanced/Local Use)

If you're running Dolibarr in a local network or test environment, a self-signed certificate may be sufficient.

Generate a self-signed cert:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-keyout /etc/ssl/private/dolibarr.key \
-out /etc/ssl/certs/dolibarr.crt

Configure Apache or Nginx to use the cert, and update Dolibarr’s URL accordingly.

Note: Browsers will show a warning for self-signed certs.

Advanced Options

• Wildcard certificates for subdomains (e.g., *.yourdomain.com)

• OCSP Stapling for faster SSL verification

• HSTS Headers to force HTTPS in browsers:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

• Secure cookies in Dolibarr PHP configuration

Troubleshooting Common SSL Issues

Issue: SSL not loading

• Cause: DNS not pointing to server

• Fix: Verify DNS with tools like dig or nslookup

Issue: Mixed content warnings

• Cause: HTTP resources (e.g., images or scripts)

• Fix: Update hard-coded HTTP links to HTTPS

Issue: Certificate expired

• Cause: Renewal failed

• Fix: Run sudo certbot renew and check cron logs

Issue: Redirect loops

• Cause: Misconfigured redirect rules

• Fix: Avoid duplicate redirects in both server and app

Why SMEs Must Secure Dolibarr with HTTPS

Small and medium-sized enterprises are often targeted by cyberattacks due to weaker infrastructure and awareness. Unencrypted CRM systems are easy entry points for attackers.

HTTPS not only protects your business data, but also:

• Ensures secure client interactions

• Builds trust with customers and staff

• Meets compliance standards

• Prevents browser warnings that may block access

Dolibarr is a powerful tool, but its security depends on proper deployment. HTTPS should be a default setup in any production environment.

Final Thoughts

Securing Dolibarr with HTTPS and SSL certificates is not just a technical detail—it’s a business necessity. With tools like Let’s Encrypt and Certbot, even SMEs with limited resources can implement professional-grade encryption for free.

From installation to renewal, from manual to fully automated setups, HTTPS can be implemented in a matter of minutes and maintained with minimal effort. Whether you’re hosting Dolibarr for five users or fifty, secure your access now to protect what matters most—your data and your reputation.