How to set up HTTPS for n8n?

To set up HTTPS for n8n in production, you normally do it by putting n8n behind a real reverse proxy such as Nginx, Traefik, or Caddy. n8n itself does not handle HTTPS termination directly in production. You let the reverse proxy handle SSL certificates (usually via Let’s Encrypt), and the proxy forwards traffic to n8n’s internal port (default 5678). If you use n8n Cloud you don’t need to do anything — HTTPS is built-in.

 

Why HTTPS Is Usually Done With a Reverse Proxy

 

n8n runs as a Node.js service. Node can serve HTTPS, but in production it’s better to offload HTTPS to a tool designed for it. Reverse proxies like Nginx and Traefik automate certificate renewal, handle TLS securely, and support load balancing, redirects, websockets, etc. This keeps n8n simpler and more stable.

• You expose port 443 (HTTPS) on the proxy.
• The proxy obtains and renews the SSL certificates.
• The proxy forwards traffic to n8n running on port 5678.

 

Production-Ready Setup With Docker + Traefik (Recommended)

 

This is the most common production setup. Traefik handles HTTPS with automatic Let’s Encrypt certificates.

Your docker-compose.yml would look like this:

version: "3.8"

services:
  n8n:
    image: n8nio/n8n
    environment:
      - N8N_HOST=yourdomain.com           // The public domain for n8n
      - N8N_PORT=5678
      - N8N_PROTOCOL=https                // Tells n8n its public URL uses https
      - WEBHOOK_URL=https://yourdomain.com/
    ports:
      - "5678:5678"                        // Internal only; Traefik uses Docker network
    networks:
      - web
    labels:
      - "traefik.enable=true"

      // Traefik router
      - "traefik.http.routers.n8n.rule=Host(`yourdomain.com`)"
      - "traefik.http.routers.n8n.entrypoints=websecure"
      - "traefik.http.routers.n8n.tls.certresolver=letsencrypt"

      // Traefik service
      - "traefik.http.services.n8n.loadbalancer.server.port=5678"

  traefik:
    image: traefik:v2.11
    command:
      - "--providers.docker=true"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=admin@yourdomain.com"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    networks:
      - web

networks:
  web:
    external: false

This setup gives you automatic HTTPS, automatic renewals, and production-grade routing.

 

Example Setup With Nginx (Manual Certificates)

 

If you already use Nginx, you can also terminate HTTPS there. This assumes you already have certificates in /etc/letsencrypt/live/yourdomain.com/.

server {
    listen 443 ssl;
    server_name yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;     // Real cert path
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;

    location / {
        proxy_pass http://localhost:5678;                                   // n8n internal port
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;                            // Important for webhooks
    }
}

server {
    listen 80;
    server_name yourdomain.com;
    return 301 https://$host$request_uri;                                    // Redirect HTTP → HTTPS
}

Then in n8n’s environment variables:

N8N_HOST=yourdomain.com
N8N_PORT=5678
N8N_PROTOCOL=https
WEBHOOK_URL=https://yourdomain.com/

 

If You’re Running n8n Cloud

 

You don’t configure HTTPS. It’s handled for you automatically.

 

Local HTTPS for Development (Optional)

 

For local testing you can use a tool like mkcert to generate trusted local certificates, then run a small reverse proxy (Caddy is easiest). But this is not required for production.

 

Common Pitfalls

 

• Forgetting to set N8N\_PROTOCOL=https — this breaks webhook URLs.
• Running n8n directly on port 443 — not recommended; you lose automatic TLS handling.
• Not opening ports 80 and 443 for Let’s Encrypt validation.
li>Using Cloudflare “Flexible SSL” — this breaks webhooks; use “Full” or “Full Strict”.

 

Summary

 

The stable and production-proven way to run n8n with HTTPS is to keep n8n on its normal internal port (usually 5678) and put a reverse proxy like Traefik or Nginx in front of it. The proxy handles certificates and exposes the secure HTTPS endpoint, while n8n focuses purely on workflow execution. This avoids TLS complexity in n8n and matches how real production deployments work.