Comment on HTTPS with FreeDNS
agressivelyPassive@feddit.de 8 months ago
How exactly is SSL terminated in your setup? Usually, you’d use something like nginx or apache for termination, but I don’t see that in your description?
So who exactly has the private key?
ProtecyaTec@lemmy.world 8 months ago
I’m still pretty green so I’m not sure what terminated means in this context.
My domain registrar for my “pretty” domain (not FreeDNS) allowed me to issue a Let’s Encrypt on it. It gave me the encrypted Cert code, Private Key code, and Immediate Cert code. I was able to bring them down into
.crtand .keyfiles respectively and assign them to my NAS. Jellyfin though required a PKCS #12 file so I installed openssl CLI via Choco and fed it my .crt and .key files to generate the necessary pfx file. So, right now all the cert information is tied to my “pretty” domain via my domain register. I would assume that my register and Let’s Encrypt has my private key info, but also my key files uploaded to the NAS and rolled into the PFK file.Not sure if that helps or answers your question but that’s the info I got.
lemmyvore@feddit.nl 8 months ago
“Terminated” means something that’s using the certificate to encrypt connections. You got the certificate but doesn’t sound like anything is actually using it.
You can give it to Jellyfin so it can start encrypting the HTTPS port. The downside is that you’ll be stuck using your pretty donation for just Jellyfin, for now.
If you decide to use it for more services later you can install a reverse proxy, get a wildcard certificate for *.pretty.domain, start creating subdomains as CNAMEs to the FreeDNS (eg. jellyfin.pretty.domain) and defining them in the reverse proxy.
The reverse proxy will be handling the forwarded port and terminate the encryption for all subdomains, and will hand-off the unencrypted connection privately to the relevant app based on which domain the visitor is using (and issuing 404 not found it they use a domain you haven’t defined).