Secure nextcloud https self certificat

[RMAZOUZI]

We are just come to deploy the nextcloud pluging on truenas core so for externat access we want to enforce the sécurity using self certificat sign is there a reliable and tested solution which could work for along time

 

[JohnDigital]

I use letsencrypt. I would say its tested and reliable, however the cert has to be renewed frequently (I think its 90 days). More specifically currently the package py39-certbot works well.

 

[RMAZOUZI]

Thanks for ur replying
It is renewing each 90 days by default or we need to configure it

 

[danb35]

If you'd used my script to create the jail, the certificate would be taken care of for you:

GitHub - danb35/freenas-iocage-nextcloud: Script to create an iocage jail on FreeNAS for the latest Nextcloud 28 release, including Caddy, MariaDB or PostgreSQL, and Let's Encrypt

Script to create an iocage jail on FreeNAS for the latest Nextcloud 28 release, including Caddy, MariaDB or PostgreSQL, and Let's Encrypt - danb35/freenas-iocage-nextcloud

github.com

Do not, under any circumstances, use plugins:

iXsystems, when are you going to stop pretending that CORE has (usable) plugins?

Plugins are broken. We all know it, and you have no intention of fixing them. Most notably, @Kris Moore has said not to use them, and that they're "more or less deprecated": using plugins on CORE is a path to sadness. The plugin system is more or less deprecated and as you can tell, somewhat...

www.truenas.com

 

[JohnDigital]

Yep @danb35 has the actual ticket for this and many other things. And like he points out the plugins are dead. Now with that said a simple script to check every 30 days or so if the certs are expiring is how i handle it. There are mountains of posts on this forum and youtube videos around to gelp you get this going. Good luck!

 

[danb35]

Now with that said a simple script to check every 30 days or so if the certs are expiring is how i handle it.

The way to handle it with any sensible ACME client (e.g., certbot or acme.sh) is with a daily-ish task to renew the certs (e.g., certbot renew). Any reasonable client when run this way will check the cert(s) and only attempt to renew it if it's within 30 days of expiring. Most such clients install such a cron task when they're installed.