Dumbfounded trying to set up SSL Certificate

[Glorious1]

I had https web access to my FreeNAS GUI up till about 6 months ago, but one day it stopped working. I go to https://192.168.0.102, and I just see the shark logo, no login form. I have to change the url to http to get the login.

Every few months I try to set up a new certificate, hoping I'll accidentally get it right, but still scratching my head. I tried to follow the process described in this resource https://www.ixsystems.com/community/resources/lets-encrypt-with-freenas-11-1-and-later.82/ and ran into errors when the script tried to create a text record on my duckdns subdomain.

So back to the standard FreeNAS method. It's convoluted, and there is nor overall description of the process to create an internal, self-signed certficate. I get what I think should work by:
1. Creating a Certificate Authority in System > CAs,
2. In System > Certificates create a Certificate Signing Request,
3. Back to CAs, use the ... menu and choose sign CSR, then choose the CSR and enter a name for the certificate. This creates a certificate in Certificates.
4. In System > General, choose the certificate as the 'GUI SSL Certificate'.

After the web engine reboots, I still get the logo only, no login. And I'm not sure if I should be manually creating a certificate in Certificates. I've tried that too, but it doesn't work either. And there seems no point when the certificate gets created automatically when signing the CSR.

There are some entries that are unclear to me. One is 'Common Name' in creating a CA and CSR. According to the Guide, this is a FQDN. I've been using my DuckDNS domain name (with my subdomain). I also tried the HostName exactly as shown in the Dashboard under System Info (Tabernacle.local), and I tried the local IP address. Clearing browser cache and history didn't change anything. I don't have any local domain name system as far as I know.

I'm grateful for any tips.

 

[Glorious1]

Still dumbfounded . . .

 

[Samuel Tai]

The CN has to match the FQDN of your server. In this case, you should use Tabernacle.local. For all the other names, these should be entered as subject alternate names (SANs):

Code:

DNS Name=Tabernacle.local
DNS Name=Tabernacle.<DuckDNS domain>
DNS Name=<WAN IP, if you're allowing connections from the Internet>
DNS Name=192.168.0.102

Chrome requires one of the SANs to match the CN.

 

[Glorious1]

Thank you @Samuel Tai. I got it to work that way, but only if use the url https://tabernacle.local/ (I use Firefox, but I put that URL in as a SAN also, just in case.)

I used to always use the IP number instead, https://192.168.0.102, and that worked on SSL. I did go through the certificate creation process using the IP as CN, and the others as SANs. But I couldn't get that to work. It seems to ignore the SANs, and doesn't like an IP as CN anymore.

Anway, it works now as stated above, and I guess I don't need to understand more than that!