Certificate issues reddit / selfhosted ---------------------------------------------------------------------- viseradius · 2023-10-01 08:20 Hi everyone, I need some help with one of my services (Paperless-NGX) I accessed it a long time via IP but as my wife is also using it I changed it to an easier hostname. (dms.local) Currently it’s running in docker and traefik is handling the access and uses https because my browser is quiet annoying without https. Now my problem: I use a self-signed certificate because of the „local“ domain and because I access the service only from my local network. How can I remove the warning that the certificate isn’t trustworthy? It stops me from using mobile apps to connect and also sometimes isn’t working with some browsers. Had someone else a similar issue? ---------------------------------------------------------------------- Astorek86 · 2023-10-01 09:24 I faced the same Problem, and did something that is quite unusual. But I also didn't find and/or come up with a better idea, so it works for me ¯\\\_(ツ)\_/¯ * I register a free domain on [DuckDNS](https://duckdns.org), for example `mypaperdmz.duckdns.org` * I set up a cronjob that'll renew the DNS-Name, as according to the DuckDNS-["Install"](https://duckdns.org/install.jsp)\-Section (if you register a domain, you'll get the full Example for Copy'n Paste). * I use Caddy as a Reverse Proxy. Caddy has a feature that it automatically gets trustworthy Lets Encrypt-Certificates to your DNS- Name. * Example-Config for Caddy (do **NOT** use it, I'll explain soon): ​ # By the way: Config-File is usually in "/etc/caddy/Caddyfile" # Do NOT use this! mypaperdmz.duckdns.org { # Let's assume "1234" is the HTTP-Port for Paperless-NGX, # and "192.168.1.20" is where Paperless-NGX is running. reverse_proxy 192.168.1.20:1234 } * Problem is: To get trustworthy Lets Encrypt-Certificates, you'll **HAVE** to Port Forward 80 & 443 to your Reverse Proxy! That usually means, your Paperless-NGX would be accessible over the internet, for everyone! We don't want that, Paperless-NGX should stay in LAN, right? We can achieve this with this Caddy-config: ​ mypaperdmz.duckdns.org { @denied not remote_ip private_ranges abort @denied reverse_proxy 192.168.1.20:1234 } * To explain the Syntax: We create a group called `denied`, in that group is every IP-Address (`remote-ip`) that isn't private (`not...private_ranges`). In other words: Group `denied` includes *every* IP-Address that'll be able to connect to your Reverse Proxy over the Internet. Private IP-Addresses (like 192.168/16, or 10/8) won't be routed through the Internet, that's why they're excluded. In the next Line, we simply abort every connection-attempt, caused by something from the Internet (`abort @denied`), using the Group. * Now you have to Port Forward 80 and 443 to your Reverse-Proxy, and restart Caddy ("systemctl restart caddy") to get the Lets Encrypt- Certificate. Your instance is still safe, because Caddy will abort every connection from the Internet that tries to reach your Reverse Proxy. But local attemts will work, because you reach your Paperless- NGX-Server inside your local Network with your Private IP-Address... * Just for the sake of completion: I assume your local Network at home uses Private IP-Addresses, like 99.999% in every household that has Connection to the Internet... I know it's a bit of a hassle and somewhat weird, but as said, I don't know a better solution to get thrustworthy Certificates, without installing every self-signed Certificate manually on every Device, and without exposing it to the Internet... If someone know a better solution, I'm happy to read or hear it\^\^. I also don't know if you can achieve the same with Traefik; I've never used it\^\^. ---------------------------------------------------------------------- DWolfUK40 · 2023-10-01 10:17 I’d personally recommend using caddy and proxying as that will automatically get let’s encrypt certificates. I’m not sure if it works on .local addresses though. It’s possibly worth grabbing a cheap domain to do it, moving it to cloudflare and then using the caddy cloudflare dns Addon to get the certificates. Then you could have external access also down the line. If you want to keep the .local domain You may have to manually add the self-signed certificate to trusted stores. This isn’t always possible so you might be SOL if you’re wanting to keep the local domain. ---------------------------------------------------------------------- Astorek86 · 2023-10-01 10:35 Caddy does automatically generate a (non-trustful) self-signed Certificate if using ".local"-Addresses, [According to their Docs ("Hostname requirements" and "Local HTTPS")](https://caddyserver.com/docs/automatic-https#local-https) ---------------------------------------------------------------------- DWolfUK40 · 2023-10-01 10:40 Yes but I don’t think that will remove the warnings the OP is getting? I’ve never used caddy like that so I’m not sure. I know it works great if used with a domain though where you can use dns verification and that would be my choice. Paperless is very handy to have external access to. I use it to import my receipts when I’m out. There’s also a ton of other services where external access is so handy too. I feel that using a .local domain is so limiting :) ---------------------------------------------------------------------- Dante_Avalon · 2023-10-01 14:10 Add said certificate into trusted repository of you PC/phone. Basically you can't get legit certificate for local domain, since, well, it's *local*, so multiple ppl can create home.local fqdn for themselves. You have one more choice - create your own root certificate, and then use it to sign certificate that you use for your system Then add said root certificate to your trusted repository on pc/phone (and turn off the system with private key of root certificate) ---------------------------------------------------------------------- viseradius · 2023-10-02 08:21 Traefik is also compatible with let’s encrypt. But it doesn’t work with .local. ---------------------------------------------------------------------- viseradius · 2023-10-02 08:23 I have something similar with an other service using traefik but I hoped that I don’t have to expose paperless. The config for blocking external traffic is also possible in traefik but the last time I tried it, it didn’t work. ---------------------------------------------------------------------- DWolfUK40 · 2023-10-02 12:55 Yeah that’s my suspicion. It will be because it needs to verify domain ownership and it can’t do that with a local domain. A cheap random domain is probably the best option. You can grab the ones with no real meaning to anybody for pennies. Now’s probably the best time to get everything “right”. Chances are this and other services being externally accessible will be handy in the future for the OP. ---------------------------------------------------------------------- dabbid0 · 2023-10-02 15:28 Try mkcert for your certificates (https://github.com/FiloSottile/mkcert). It creates a local CA for you and with it you sign the certificates. You add the CA certificate to your devices and the apps work, and in browsers you will no longer have insecure certificate notices.