Skip to main content
For secure transfer of data among ABBYY FlexiCapture components, a secure network connection is required.

​
Secure your connection with HTTPS

By default, ABBYY FlexiCapture is configured to use the HTTP protocol, which is only recommended for staging, testing or demo environments.
The HTTP protocol is also used to transmit data between the Web Scanning Station and the ABBYY Scanning Plugin, since the scanning plugin is designed exclusively to be deployed locally on the user’s machine.
For production use, HTTPS must be used to protect sensitive data.
Diagram showing ABBYY FlexiCapture clients connecting over HTTPS through a firewall and a 1 Gb/s network switch to the Application Server and FlexiCapture Processing Stations.
To use HTTPS, enable SSL support in the IIS settings. To work with IIS over HTTPS, you need to obtain a certificate for the server. For more information about managing certificates, see this section of the Microsoft website. In the IIS settings, specify the HTTPS protocol for the default website:
1

Open IIS Manager

Run the IIS Manager console from the Control Panel.
2

Open the site bindings

Select Default Web Site and click Bindings in the Actions pane.
Screenshot of IIS Manager with Default Web Site selected and the Bindings action highlighted in the Actions pane.
3

Add an HTTPS binding

In the dialog box that opens, click Add and select https from the Type drop-down list.
4

Select the SSL certificate

From the SSL Certificate drop-down list, select a certificate and click OK.
Screenshot of the Add Site Binding dialog in IIS Manager with https selected as the type and an SSL certificate chosen.
5

Require SSL (optional)

If you want a site to be available via HTTPS only, select the site in the tree pane, double-click SSL Settings in the content pane, and select the Require SSL option.
As client certificates are not verified, set the Client certificates option to Ignore when configuring SSL.
Once the certificate has been added, the Application Server address must be prefixed with “https” (that is, https://<server name>) and the name of each client machine connecting to the Application Server must match the name in the certificate. You will need to specify the Application Server address on the Processing Server, on user stations, and on web stations. To specify the Application Server address on the Processing Server:
1

Start the Processing Server Monitor

Start the Processing Server Monitor.
2

Open the Change Application Server dialog

Open the Processing Server shortcut menu and select Change Application Server.
3

Enter the address

In the dialog box that opens, specify the address: https://<server name>.
The Application Server address must also be specified when you start a user station or open a project. When working on a web station, enter the URL in the following format: https://<server_name>/FlexiCapture12/<web_station_name>.

​
TLS 1.2 for data encryption

ABBYY FlexiCapture 12 supports the TLS 1.2 protocol, which is the recommended encryption protocol for secure connections. When connecting to ABBYY FlexiCapture, other protocols can be used at the operating system level. For detailed instructions on how to restrict the use of certain protocols, see this section of the Microsoft website.

​
Secure your connection with Mutual SSL

By default, when configuring HTTPS, one-way SSL authentication is configured. This means that the client will verify the authenticity of the server certificate. You can make the connection more secure by using Mutual SSL, so that the client will verify the authenticity of the server certificate and the server will verify the authenticity of the client certificate. To configure Mutual SSL for the Application Server, complete the following steps:
1

Set HTTPS as the protocol

In IIS, specify HTTPS as the protocol to be used for connections to the Application Server (see Secure your connection with HTTPS above).
2

Require SSL for the server folder

For Default Web Site\FlexiCapture12\Server, select the Require SSL option in SSL Settings.
3

Require client certificates

For Client certificates, select the Require option.
Now a client will need to provide a certificate when connecting to the Application Server:
  • Project Setup Station and Verification Station: No additional configuration is required. When connecting, the client will be asked to select a certificate to provide to the Application Server.
  • Processing Server and Processing Station: Specify the thumbprint of the appropriate certificate in the registry. Locate HKLM\Software\ABBYY\FlexiCapture\12.0\FlexiBr in the registry and specify <ClientCertificateThumbPrint>.
  • Administration and Monitoring Console: Specify which certificate to provide by modifying the web.config file with the following keys:
The client certificate with the specified thumbprint must be stored in Local Computer > Personal, and the account providing the certificate must have permission to use it. For detailed information, see this section of the Microsoft website.
Mutual SSL cannot be configured for the Web Scanning Station or the Web Capture Station.

​
Secure your connection to the database and file storage

The Application Server interacts with the database and file storage.
Diagram showing the Application Server connected over a 1 Gb/s network switch to the File Storage and the Database.
To secure your connection to an SQL, SQL Azure, or Oracle database, we recommend using the TLS 1.2 encryption protocol. Configure TLS in the database: The Application Server uses SMB protocols to interact with file storage. A number of security enhancements were introduced in SMB 3.0. For detailed information, see this section of the Microsoft website.