Home self hosting SSL certificates reddit / selfhosted ---------------------------------------------------------------------- Optimus_sRex · 2023-10-05 15:50 I have set up a Raspberry Pi 4 with Docker and several self hosted instances running regularly, and I'd love to secure this all with a reverse proxy and SSL certs. None of this network is exposed to the Internet and for security I'd prefer not to. So how does one go about creating SSL certs inside a local network that don't give you the big scary warning in most browsers? Is there a recommended way to do this without buying a domain for home use? ---------------------------------------------------------------------- thekrautboy · 2023-10-05 16:08 You dont need to buy a domain to get valid SSL certs for your home offline services. But you need a valid domain, so get a free one or just subdomains from Duckdns.org or DeSEC.io for example. Both of those support the Lets Encrypt dns01-challenge to prove ownership of the domain, and it doesnt require opening any of your services to the internet, not even the reverse proxy. Tons of guides about this exact thing exist already, please just use the search. ---------------------------------------------------------------------- Raithmir · 2023-10-05 16:09 I've just set up a Step-CA instance, not on a Raspberry Pi, but I did see they have a specific article on setting it up on a Pi. [https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi- yubikey/](https://smallstep.com/blog/build-a-tiny-ca-with-raspberry- pi-yubikey/) There are much simpler options though, [https://github.com/FiloSottile /mkcert](https://github.com/FiloSottile/mkcert) or just using openssl. ---------------------------------------------------------------------- CCCoderDE · 2023-10-05 16:09 1. buy a cheap domain for yourself 2. add a dns record using the LAN ip of your rpi 3. get a ssl cert from letsencrypt using dns-challenge 4. install the cert on your rpi 5. success :) ---------------------------------------------------------------------- Vuki99 · 2023-10-05 16:15 You can easily combine duckdns with letsencript and certbot to setup ssl. If you want a remote access and dont have a public ip/cant open up ports with your current provider take a look at zerotier. ---------------------------------------------------------------------- Boonigan · 2023-10-05 16:17 I've got a two part write up on setting up an internal Nginx instance and then enabling SSL on it! Part one: https://tcude.net/hosting-internal-sites-with-nginx/ Part two: https://tcude.net/enabling-https-for-your-internal-nginx- instance/ Let me know if you have any questions! ---------------------------------------------------------------------- yusing1009 · 2023-10-05 16:56 I’ve just did this few days ago :P 1. Buy a cheap domain, then change the nameserver to Cloudflare. 2. Create an A record of wildcard * to point to your reverse proxy server (i.e. 100.x.x.x for Tailscale vLAN ip) 3. With certbot and certbot cloudflare plugin, get a wildcard ssl cert for your domain with dns challenge. 4. Import fullchain.pem and privkey.pem to Nginx Proxy Manager and name it meaningfully. 5. Select the imported cert in SSL tab for every entry on NPM 6. Be happy 😃 ---------------------------------------------------------------------- geo38 · 2023-10-05 17:56 > Note: this guide assumes you already have the DNS for your domain managed by Cloudflare. ---------------------------------------------------------------------- mistersinicide · 2023-10-05 18:20 You can use openssl to generate your own Certificate Authority and Self Sign Server Certificates with that Certificate Authority, Then for each computer that accesses that web ui will need to have this Self created Certificate Authority added to it's own truststore. This is what I do for my own internal network, I create my own internal domain (e.g. coolnetwork.lan) and I generate certs for each subdomain I want (e.g. uptimekuma.coolnetwork.lan) and I can access it without SSL warning. Of course if you want to go a more official route, then sure buy a domain name and use LetsEncrypt for valid certs as everyone else is suggesting. ---------------------------------------------------------------------- phein4242 · 2023-10-05 18:22 https://pki-tutorial.readthedocs.io/en/latest/ ---------------------------------------------------------------------- sza_rak · 2023-10-05 18:47 This is the way. Some software has nice setup for dns challenge. I like nginx-proxy- manager for this (while actually I find it awful from UI/usability perspective) which just took my API credentials to my provider and does this for me entirely. ---------------------------------------------------------------------- Either-Swan-1407 · 2023-10-05 21:48 Cloudflair and origin certs for the win. ---------------------------------------------------------------------- edguy3 · 2023-10-05 21:50 I've wanted to switch to the traefik reverse proxy for some time to achieve a flexible reverse proxy with SSL certs. In addition to solving the certificate problem, I wanted to bring up new containers without having to reconfigure apache or nginx.. Recently I found an approach using traefik.me I documented it here: https://github.com/edguy3/traefik.me Hope this helps /ed ---------------------------------------------------------------------- G1zm0e · 2023-10-06 00:01 This is the way! I have been working on getting this on kubernetes! ---------------------------------------------------------------------- rocket1420 · 2023-10-06 00:39 Techno Tim has a video on this, something like "ssl everywhere!" I dunno if it's too old to still be relevant, but I don't think so. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-10-06 10:19 There are three ways: * use [home.arpa](https://home.arpa) special-use domain (RFC 8375) and spin your local CA with stepCA, XCA or go 'the only true way' with OpenSSL * buy a $3-$10 domain and perform DNS challenges with registrar's API to get certs from Let's Encrypt. Note that publicly available CT logs ***may*** **log IP address** from where you made the request, and this info may go public eventually. * use something like [https://www.getlocalcert.net/](https://www.getlocalcert.net/) (a combination of the previous two) ---------------------------------------------------------------------- airclay · 2023-10-06 10:46 I just use Caddy in a container. Handles my reverse proxies and certs all at once ---------------------------------------------------------------------- johndoe937262949 · 2023-10-06 12:08 [mkcert](https://github.com/FiloSottile/mkcert) is a simple tool for local certs. ---------------------------------------------------------------------- ffimnsr · 2023-10-06 12:38 Openssl is your friend. Just create a self-signed CA add it to trust on all computers. Then if its client to server then go for self-signed mTLS + CA. ---------------------------------------------------------------------- bbluez · 2023-10-06 14:20 I'll second the benefits of nginx x proxy manager. Combined with cloud flares DNS API it makes these challenges super simple and gives you the ability to get wild card certificates for internal use. ---------------------------------------------------------------------- Optimus_sRex · 2023-10-06 16:47 Yeah, doing some follow up searches, I found this video that goes through the whole process: [https://www.youtube.com/watch?v=qlcVx-k- 02E](https://www.youtube.com/watch?v=qlcVx-k-02E) Pretty simple. Thanks everyone. ---------------------------------------------------------------------- edguy3 · 2023-10-10 20:07 The benefit of this approach is that it grabs valid certificates for .traefik.me and routes to your local network/host.