[deleted]
Look into let’s encrypt and acme. Requires a publicly registered domain though.
[deleted]
Submitted 1 day ago by jobbies@lemmy.zip to selfhosted@lemmy.world
Comments
performation@feddit.org 1 day ago
x1gma@lemmy.world 1 day ago
The easiest way would be to set up caddy to use acme on the servers, and never care about certificates again. See caddyserver.com/docs/automatic-https.
If you insist on your centralized solution, which is perfectly fine imo, just place the certificates to a directory properly accessible to caddy, and make sure to keep the permissions minimal, so that the keys are only accessible by authorized users.
If the certificates are only for caddy, there’s no reason to mess around in system folders.
Joelk111@lemmy.world 21 hours ago
I used NGINX with Certbot and haven’t had to manually touch anything HTTPS, it’s great.
Bakkoda@lemmy.world 15 hours ago
It just works. Home assistant monitors and let’s me know if anything expires but it never has.
Decronym@lemmy.decronym.xyz 23 hours ago
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters DNS Domain Name Service/System IP Internet Protocol SSL Secure Sockets Layer, for transparent encryption
[Thread #53 for this comm, first seen 1st Feb 2026, 15:40] [FAQ] [Full list] [Contact] [Source code]
just_another_person@lemmy.world 1 day ago
If you’re solely talking about Caddy using self-signed, just use the caddy directory created for this. Should be simple.
The global /etc/SSL dir is locked down for a reason, and you shouldn’t relax permissions there just so Caddy can get to subdirs.
iamthetot@piefed.ca 22 hours ago
I could never get certs working over locally served stuff, but Nginx Proxy Manager made the few things I publish to web fairly easy to get https working. I’m just commenting to come back later and read the answers myself… Let me know if you get it working over Lan!
hendrik@palaver.p3x.de 1 day ago
You could try to debug the permission issue… Like take a note of the current permissions, chmod the certificates to 666 and the parent directories to 777 and see if that works. Then progressively cut them down again and see when it fails. And/or give caddy all the group permissions ssl, acme, certwarden… and then check which one makes it fail or work.
immobile7801@piefed.social 23 hours ago
I always recommended people new to reverse proxies start with Npm. Reverse proxies are designed to do exactly what you’re trying to do, although I’m not sure why you’ve brought in certwarden. In npm just put in the IP:Port of the host (local or remote) same goes for caddy, but in my experience its not as easy to configure as npm
4am@lemmy.zip 1 day ago
You mean you have a script that pulls in the cert from a central source (where certwarden renews it), and then caddy can’t access it locally?
Exactly what error is Caddy giving? What permissions have you tried and what was the result? How are you restarting Caddy after renewal? Why do you have multiple reverse proxies?
androidul@lemmy.world 1 day ago
how about making symlinks to the dir where caddy expects them
Mozart409@lemmy.world 1 day ago
Does the caddy user have the permissions to read the files ? I ran into that problem as well. If only caddy needs the cert I moved them into /etc/caddy, chowned the dir again, make sure you use the full path of the cert so /etc/caddy/domain.crt not ./domain.crt
antithetical@lemmy.deedium.nl 1 day ago
Oh certificates are so much fun and you have so many options. From fairly easy to mindboggling complex.
Your current solution is OK if you keep in mind security implications of distributing certs using scripts.
It is not entirely clear where you do your tls-termination but it sounds like that is the Caddy reverse proxy so that is where your certs should be.
Placing them in a location like
/etc/ssl/example_com/asfullchain.premandprivkey.pemis probably easiest. Make sure access rights are appropriate. Then point Caddy at them and it should work. No experience with Caddy itself. If the services run in Docker be sure to map the certificates into the container.Alternatively you can set up a PKI with certificates for your services behind the reverse-proxy for internal encryption and do public tls termination in the proxy with Let’s Encrypt.
BlackEco@lemmy.blackeco.com 1 day ago
I do not understand why you are using certwarden when Caddy can generate SSL certificates by itself.
jobbies@lemmy.zip 1 day ago
BlackEco@lemmy.blackeco.com 1 day ago
But you’re still using Caddy as the sole reverse proxy, don’t you? Do you have multiple Caddy instances that require access to a single certificate?
poVoq@slrpnk.net 1 day ago
If you switch to the dns-01 challenge you can just generate the certs on multiple servers hasselfree. And as a bonus you can get wildcard certs for subdomains.