Britixo CRMBritixo CRMEnterprise Help Centre
Ctrl K
Shared server guidance · Question & answer

How do I open HTTPS in firewalld and make the rule persist?

Add the HTTPS service to the zone that actually handles the public interface. A runtime addition takes effect immediately but can disappear after reload or restart. Once tested, add the same approved service to permanent configuration instead of saving unrelated temporary changes wholesale.

IntermediateLinux servers with active firewalld

Britixo Help Centre · Updated

Go to the answer

Before you start

  • Confirmed interface-to-zone mapping.
  • A working HTTPS listener.
  • Permission to expose HTTPS and independent administrative access.

Instructions

1. Confirm zone and service definition

Use the actual zone name in place of public. A local service definition may be customised, so inspect what https represents before enabling it.

Remote Linux shell
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --info-service=https
sudo firewall-cmd --zone=public --query-service=https

Checks the active mapping, the service definition and whether the runtime zone already allows it.

2. Test the runtime addition

Add only the approved service, then make a real HTTPS request from an external client. A successful query-service result proves rule presence, not application reachability.

Remote Linux shell
sudo firewall-cmd --zone=public --add-service=https
sudo firewall-cmd --zone=public --query-service=https

Applies and checks the runtime HTTPS addition.

3. Persist the matching rule

After the external test succeeds, add that same rule to permanent configuration. No reload is required to activate a rule already added to runtime.

Remote Linux shell
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --permanent --zone=public --query-service=https

Saves and checks the specific permanent service entry.

Check the result

  • HTTPS is present in both the correct runtime zone and permanent zone.
  • The public hostname responds correctly from an authorised external client.

Troubleshooting

The rule is present but the site is unreachable
Check the actual listener, upstream firewall and DNS. Verify that the tested traffic really belongs to the selected zone.

Official references

Use the documentation for your installed version when a flag, service name or platform feature differs.