# Run Express in Production

Source: https://developers.bitgo.com/docs/get-started-express-production

## Overview

Running BitGo Express in the production environment requires additional security configurations that aren't necessary in the test environment. BitGo strongly recommends securing and authenticating your connections in the production environment with Transport Layer Security (TLS) and HTTPS. However, if your use case cannot use these security protocols, you can configure your own self-certificates.

> 📘 **Note**
>
> If you must disable TLS, you can opt out using the `disableSSL` configuration option. However, BitGo strongly recommends always enabling TLS. Disabling TLS makes you vulnerable to a man-in-the-middle attack, where a hacker can gain access to your sensitive information, as it's sent in cleartext over the Internet.

## Prerequisites

[Install BitGo Express](/docs/get-started-express-install)

## 1. Generate TLS Key and Certificate

You can generate a TLS key and certificate using a trusted certificate authority (CA) or you can generate a self-signed certificate.

<Tabs>
<Tab title="Use Certificate Authority (CA)">
### 1.1. Generate Key

```shell
openssl genrsa -out private.key 2048
```

#### Step Result

You generated a 2048-bit RSA private key and saved it to a file named `private.key`.

```shell
Generating RSA private key, 2048 bit long modulus
.......+++++
.......................+++++
```

### 1.2 Generate Certificate Signing Request (CSR)

If using a CA, you must generate a certificate signing request (CSR) and send it to the CA. To generate a CSR, run the following command and answer the questions that display in your terminal:

```shell
openssl req -new -key private.key -out request.csr
```

#### Step Result

You generated a CSR and saved it to a file named `request.csr`.

### 1.3 Submit CSR to CA

Submit your CSR file, `request.csr`, to a trusted CA for signing. Follow the instructions outlined by your preferred CA.

#### Step Result

Once the CA processes your CSR and completes any necessary verification, you're issued a signed certificate for your domain. Save the signed certificate to a file, with a `.crt` extension.
</Tab>
<Tab title="Use Self-Signed Certificate">
### 1.1 Make Certificates Directory

To generate a self-signed certificate, make a `certs` directory within the `express` directory and navigate it.

```shell
mkdir certs

cd certs
```

#### Step Result

You created a `certs` directory within the `express` directory and navigated to it.

### 1.2 Generate Key and Certificate

To generate a key and self-signed certificate, run the following command and answer the questions that display in your terminal:

```shell
openssl req -newkey rsa:2048 -nodes -keyout cert.key -x509 -days 3650 -out cert.crt
```

#### Step Result

- You generated a 2048-bit RSA private key and saved it to a file named `cert.key`.
- You generated a self-signed certificate and saved it to a file named, `cert.crt`.
</Tab>
</Tabs>

## 2. Pull the Latest Docker Container

```shell
docker pull --platform linux/amd64 bitgo/express:latest
```

## 3. Run Docker Container

Run the Docker container with the following modifications to enable TLS:

```shell
docker run --platform linux/amd64 -it -e NODE_ENV=production --volume /path/to/certs:/private -p 4000:4000 bitgo/express:latest -p 4000 -k /private/cert.key -c /private/cert.crt -e prod

# The prefix `NODE_ENV=production` turns off certain debugging functionality that could potentially leak information about your system
# Replace `/path/to` with the full path to your `certs` folder
# The `keyPath` and `crtPath` configuration options enable TLS
```

#### Step Result

```shell
BitGo-Express running
Environment: prod
Base URI: https://0.0.0.0:4000
```

## 4. (Optional) Build Docker Container

If you want to build the BitGo Express Docker container yourself from the source code, run the following commands from the root of your cloned BitGoJS repository.

```shell
git clone https://github.com/BitGo/BitGoJS.git

cd ./BitGoJS

docker build -t bitgo-express:latest .

docker run -it bitgo-express:latest
```

## Next Steps

Get started making Express calls in the production environment. For more details, see [Wallets Overview](/docs/wallets-overview).

## See Also

* <a href="https://hub.docker.com/r/bitgo/express/tags" target="_blank" rel="noreferrer">Docker Hub: bitgo/express</a>
* [Reference Configuration Parameters](/docs/get-started-express-reference)