Skip to main content

SSL Certificates

SSL certificates are used to provide secure and verifiable communication over network. Homecloud device is shipped with a self-signed SSL certificate. With self-signed certificate web browsers show a SSL warning when opening Admin console page. And apps like Password Manager will not work with iOS and Android clients. There are two options to get a CA certificate:

  1. Configure VPN: During VPN configuration Homecloud generates a CA signed certificate using Tailscale provided DNS name (homecloud.tailxx.net) You can use this name to connect from all VPN connected access devices. No further action is needed once you connect to VPN.

  2. Bring your own certificate. If you don't want to connect Homecloud to VPN and still use password manager apps then you can import your own certificate in Homecloud. Refer instructions below to configure.

Importing your own SSL certificate​

To generate and import your own certificate follow the below steps:

  1. Decide the hostname: Hostname for Homecloud device and the certificate you will generate should match. To generate a certificate you need to own a domain name and should have access to it's public DNS and add a record. For example: If you own a domain say mydomain.com then you can choose to create a hostname: homecloud.mydomain.com.

  2. Set the hostname in Homecloud device: After finalizing hostname, it needs to be configured on Homecloud. To configure: On admin console navigate to Advanced Settings > Hostname. Edit hostname and domainname as needed and save. This should be same as DNS name of certificate generated. E.g. for hostname homecloud.mydomain.com enter homecloud in hostname field and mydomain.com in domain. Press Save. Apply changes when prompted. Verify FQDN.

  3. Create an A record for hostname in your DNS server. Ensure your DNS points to correct IP address (as determined in step 2) of Homecloud device. If your Homecloud device will only be accessible on your local network LAN then set the DNS A record to the local static IP assigned to Homecloud. If you have not assigned static IP to Homecloud refer to DHCP Reservation to assign.

  4. Buy a commercial SSL certificate: You can buy a certificate for your domain from commercial CA like DigiCert.

  5. Generate SSL certificate: If you don't want a commercial certificate then follow your hosting provider instructions to generate SSL certificate for your hostname or you can use certbot utility to generate Let's Encrypt SSL certificate. Install certbot utility on your computer (Search for your OS specific instructions) After installing generate a certificate using command certbot certonly --manual --preferred-challenges dns -d hostname. Replace hostname with your full hostname. On prompt enter your details. It will ask you to create a TXT record on your DNS server with certain values. This is needed to verify that you have write access to nameserver of the domain. Once done it will privkey.pem and fullchain.pem files. On Windows computer these files are located at c:\Certbot\live\ There will be a sub-folder with your domain name. Keys will be located inside that.

  6. Import certificate in Homecloud: Navigate to Advanced Settings > SSL and press + button. Choose Import. Browse to privkey.pem and in 2nd column browse to fullchain.pem files generated above. Tag should be BYOC. Press Import. After applying changes restart Homecloud.

  7. In your browser type https://hostname (Replace hostname with hostname set in step 2). If everything is configured correctly you should not get any SSL certificate warnings to open the admin console. If you have configured any apps then those need to be reconfigured with the new hostname. Follow app specific Access instructions on Admin console page.

IMP: You will need to renew the certificate manually. Expiry date is shown in SSL page against the certificate. On expiry delete the certificate and add a fresh one.