Domain names and SSL

[1337Hacker]

It's about time I start using SSL on FreeNAS and found some great articles on the process:

Let's Encrypt with FreeNAS 11.1 and later

Integrating Let’s Encrypt TLS Certificates with FreeNAS FreeNAS has long had the ability to use HTTPS for the web GUI, but that has usually meant dealing with self-signed certificates and the associated headaches, or paying for a commercial...

www.ixsystems.com

HOW-TO: Set up NGINX to reverse proxy your jails w/ Certbot

Disclaimer: -I'm making this guide simply to help other people, i just put together multiple guides found on the internet (which i'll post below). This is meant to be as easy as it gets for a newbie to get NGINX to reverse proxy using https. -What is a reverese proxy...

www.ixsystems.com

One thing that seems to be overlooked that I do not understand: domains

Is the domain used for anything other than issuing the certification?
Does the domain have to be bound/attached to the FreeNAS server somehow? If so, how?
Can the domain be used for a pre-existing website? With an already issued SSL?
Do you need to keep control over the domain after 3 months for certbot?

I can't seem to find a straight answer regarding this topic. I also do NOT want to allow public IP access to the server. Someone please drop some knowledge!

 

[danb35]

Does the domain have to be bound/attached to the FreeNAS server somehow?

Yes.

If so, how?

In your local DNS records. Generally this is something that would be done in your router, assuming your router provides DNS service for your LAN.

Can the domain be used for a pre-existing website?

Kind of. If you have www.yourdomain.com on an existing website, you could set up freenas.yourdomain.com for your NAS.

Do you need to keep control over the domain after 3 months for certbot?

Not for certbot--it only checks control at the time of issuance. But if you don't keep control, the cert isn't worth too much.

 

[Yorick]

Highly recommend doing this with dynamic DNS. There are dynamic DNS providers that work with Let's Encrypt. dynu is one, you'll use their API and acme.sh supports it. There may be others.

I am doing this right now for a single domain; I have yet to set up nginx to do it for multiple services. On the todo list :)

Edit: Nice list of DNS providers that support DNS validation with ACME: https://docs.traefik.io/https/acme/ . Dynu is on there, so is Dyn, DuckDNS, MyDNS.jp, the list goes on. Plenty of options.
Edit2: The reason I chose dynu for my own setup is a) it works seamlessly with acme.sh and b) it supports AAAA records and a whole bunch of other things beyond just "A" and c) there was an easy update agent available, so my IP is always up-to-date.

 

[1337Hacker]

Thank you for all the information!

In your local DNS records. Generally this is something that would be done in your router, assuming your router provides DNS service for your LAN.

If that can be done with port triggering, then yes. Are there any guides to set this up? There's a lot of information for domain controllers and VPNs, but I do not believe that's what I'm trying to accomplish.

Edit: Nice list of DNS providers that support DNS validation with ACME: https://docs.traefik.io/https/acme/ . Dynu is on there, so is Dyn, DuckDNS, MyDNS.jp, the list goes on. Plenty of options.

I suppose it's an annual registration cost, but will acme.sh work with NameCheap domains? It looks like it's on the list, but I've read a lot of articles where Cloudflare is preferred for some reason.

I am doing this right now for a single domain; I have yet to set up nginx to do it for multiple services. On the todo list :)

Maybe we should put together an up-to-date post about the process. I know I'm not the only one scratching my head with this. Plus I'm not sure how many of these help articles are still current.

 

[danb35]

And will acme.sh work with NameCheap domains or is Cloudflare preferred?

acme.sh doesn't care in the least who your domain registrar is. Unless you're using DNS validation, it also doesn't care who hosts your DNS. If you are using DNS validation, you need to either write your own script to update your provider's records, or use one of the supported DNS hosts. That list is here:

dnsapi

A pure Unix shell script implementing ACME client protocol - acmesh-official/acme.sh

github.com

 

[me@act]

Highly recommend doing this with dynamic DNS. There are dynamic DNS providers that work with Let's Encrypt. dynu is one, you'll use their API and acme.sh supports it. There may be others.

I am doing this right now for a single domain; I have yet to set up nginx to do it for multiple services. On the todo list :)

Edit: Nice list of DNS providers that support DNS validation with ACME: https://docs.traefik.io/https/acme/ . Dynu is on there, so is Dyn, DuckDNS, MyDNS.jp, the list goes on. Plenty of options.
Edit2: The reason I chose dynu for my own setup is a) it works seamlessly with acme.sh and b) it supports AAAA records and a whole bunch of other things beyond just "A" and c) there was an easy update agent available, so my IP is always up-to-date.

Hello Yorick,

I know it's a very old thread, but I am new to the TrueNas area. Hope you can help me setting up SSL with Dynu. Could you please tell me the steps to achieve that?

* I have Scale installed, and my own domain set up with Dynu. The domain name is resolving to my real IP already.

Thank you in advance.

Meact.

 

[Yorick]

I'm afraid I've forgotten everything I ever knew about that. I am using CloudFlare these days, with https://github.com/joshuaavalon/docker-cloudflare

 

[me@act]

I'm afraid I've forgotten everything I ever knew about that. I am using CloudFlare these days, with https://github.com/joshuaavalon/docker-cloudflare

Never mind, Yorick. I will try to figure it out.

BTW, I like the name Yorick, which is what I named my little :)