Certificate and Internet Requirements

  • From Nintex Automation 5.7 onwards there are two different apps for SharePoint. The legacy Nintex K2 for SharePoint: used for SharePoint on-premises and upgraded environments for SharePoint Online, and Nintex Automation for SharePoint: used on new installations for SharePoint Online.

  • Existing customers upgrading to Nintex Automation 5.7 use the legacy app from the SharePoint App Catalog for all SharePoint environments. New installations of Nintex Automation use the legacy app from the SharePoint App Catalog for SharePoint on-premises, and the new Nintex Automation for SharePoint app (SPFx) for SharePoint Online.

Carefully read this section to determine where and when you need the product web sites and endpoints to be signed by a valid certificate and available on the internet.

Using a Certificate

We recommend using a certificate issued by a Certification Authority (CA) that is trusted by Windows, and that the same certificate is used for all web sites and endpoints.

Keep in mind, however, that the system generates and uses a self-signed certificate for web sites selected during installation that do not already have certificates.

Although you can use this self-signed certificate or a domain certificate, it is primarily for test scenarios. Nintex highly recommends using a certificate issued by a trusted CA to avoid both browser and remote event receiver certificate errors.

SharePoint Online requires that the certificate associated with SharePoint remote event receiver endpoint in Nintex Automation (https://{K2WebSite}/SP15EventService/RemoteEventService.svc) be issued by a CA that is trusted by Windows.

Errors associated with SharePoint Online remote event receivers, including invalid certificates, may take up to 24 hours to appear in the SharePoint Online logs (if at all).

You must be aware of your requirements when choosing an SSL certificate. For example, a single wildcard certificate for *.domain.com, works for the following domains:

  • runtime.domain.com
  • designer.domain.com
  • apps.domain.com

However, because the wildcard certificate only covers one level of sub-domains, the following domains are not valid for the *.domain.com certificate:

  • data.runtime.domain.com
  • forms.designer.domain.com
  • app-123356.apps.domain.com

To avoid false-negative SSL warnings such as ERR_CERT_COMMON-NAME_INVALID in distributed or load-balanced environments, you may need to configure your certificates with Subject Alternate Names or use wildcard certificates. The specific configuration and certificates needed will depend on your environment’s configuration. Consult with your network security specialists to determine which certificates will be necessary in your environment.

Exposing Sites on the Internet

The web sites and SharePoint remote event receiver endpoints may need to be accessible on the internet depending on your scenario.

  • User Browser (Intranet Only): Web sites do not need to be internet-accessible when accessing those sites from within the company intranet or via VPN.
  • User Browser (Remote Access): Web sites do need to be internet-accessible when accessing these sites from outside the company intranet or VPN.
  • SharePoint Online Remote Event Receivers: The SharePoint remote event receiver endpoint in Nintex Automation (https://{K2WebSite}/SP15EventService/RemoteEventService.svc) must be internet-accessible when building event-based processes for SharePoint Online.