Looking for help with SSL certificates
reddit / selfhosted

----------------------------------------------------------------------
crayiii · 2023-12-13 10:03

We live in a remote area.  Because of the sporadic internet
connectivity, we self host as much as possible.  We have about a dozen
services (Nextcloud, ebooks, audiobooks, photos, project management,
inventory, etc.)  All of these are running in Docker.

We do have satellite internet and run Tailscale so we can access these
services when away.  The main issue that we run into is with SSL
certificates.  Some applications, such as the Bitwarden app, simply
will not connect to the server because it won't accept the self signed
cert that the docker container created.

Is there a way to create valid certificates for these services that
does not require opening them up to outside the LAN?  We either use
the internal IP address with a specified port number or the server
name with the port number to connect so we don't have any kind of
.com.

​

----------------------------------------------------------------------
Swedophone · 2023-12-13 10:10

> Is there a way to create valid certificates for these services that
does not require opening them up to outside the LAN?

If you don't want to set up your own CA then it's possible to get free
certs with Let's encrypt using DNS challenge.

----------------------------------------------------------------------
Nice_Discussion_2408 · 2023-12-13 10:22

https://doc.traefik.io/traefik/master/https/tailscale/

https://caddyserver.com/docs/caddyfile/directives/tls#tailscale

----------------------------------------------------------------------
thekrautboy · 2023-12-13 10:36

Look up guides for Lets Encrypt to get valid trusted SSL certs for
your domain. Doesnt need to be a purchased domain, you could use a
free subdomain from like DuckDNS.org or DeSEC.io as example. But it
needs to be a valid public domain. Typically this is then combined
with a reverse proxy to automatically renew the certs and to provie
HTTPS for services that dont do it themselves (like
bitwarden/vaultwarden).

Plenty of guides and discussions about this exist, it gets asked
constantly, use the search.

----------------------------------------------------------------------
horus-heresy · 2023-12-13 11:22

I found Nginx proxy manager to be less hassle and more intuitive than
those 2

https://nginxproxymanager.com/guide/#project-goal

----------------------------------------------------------------------
josemcornynetoperek · 2023-12-13 11:29

So why you don't use a domain inside your LAN? It is much comfortable
instead of ip:port.
In that case you can generate an wildard certuficate in letsencrypt
and using it inside a LAN. And that works.

----------------------------------------------------------------------
Nice_Discussion_2408 · 2023-12-13 11:41

caddy and traefik integrate directly with the tailscale daemon so you
don't need to purchase a domain, configure letsencrypt or deal with
split-horizon dns:

https://tailscale.com/kb/1153/enabling-https/

----------------------------------------------------------------------
hereisjames · 2023-12-13 11:48

Apart from these good suggestions there is also
https://www.legocerthub.com/ which is maintained by a kind Redditor.
I'm using it and I'm very happy with it.

----------------------------------------------------------------------
MaxxiK97 · 2023-12-13 15:04

I think you can do this within Tailscale itself.
https://tailscale.com/blog/tls-certs/