Configuring and enforcing HTTPS
Web traffic should not travel through the internet in plain text. When exposing the Odoo server on a network, HTTPS should be used to encrypt the traffic.
In some cases, it might be acceptable to use a self-signed certificate. Keep in mind that using a self-signed certificate provides limited security. While it allows for traffic to be encrypted, it has some security limitations, such as not being able to prevent man-in-the-middle attacks, or not being able to present security warnings on recent web browsers.
A more robust solution is to use a certificate signed by a recognized authority. This is particularly important when running e-commerce websites. Another option is to use a Let's Encrypt certificate, and the Certbot program automates getting SSL certificates for it. See https://certbot.eff.org/instructions to learn more.
Next, we will see how to create a self-signed certificate, in case this is the preferred choice.