Making FreeNAS 11.3 a secure connection with HTTPS

[Markeyse]

Hello everyone! I just installed my new FreeNAS box, and I was following the video to add in the certificates so my browser will route it to HTTPS, and followed this video right here to get the CA and Certificates set. I think because everything is new that I am not getting it to work, and it is saying the connection isn't secure. Anyone please tell me what I am doing wrong. Thank you! I'm using the New Microsoft Edge and Chrome.

 

[danb35]

it is saying the connection isn't secure.

Assuming that video is using the built-in CA, you're still going to have certificate errors with any of your client computers unless you download and trust that CA's cert on all of your client computers. If you're using a self-signed cert, you're always going to have certificate errors.

If you own a domain, the best thing to do is to get a real, trusted cert from a real CA. If you have a supported DNS provider, you can get that following these instructions:

Let's Encrypt with FreeNAS 11.1 and later

Integrating Let’s Encrypt TLS Certificates with FreeNAS FreeNAS has long had the ability to use HTTPS for the web GUI, but that has usually meant dealing with self-signed certificates and the associated headaches, or paying for a commercial...

www.ixsystems.com

FreeNAS 11.3 includes a little bit of this capability built-in, but only for one DNS host, IIRC.

 

[Markeyse]

Assuming that video is using the built-in CA, you're still going to have certificate errors with any of your client computers unless you download and trust that CA's cert on all of your client computers. If you're using a self-signed cert, you're always going to have certificate errors.

If you own a domain, the best thing to do is to get a real, trusted cert from a real CA. If you have a supported DNS provider, you can get that following these instructions:

Let's Encrypt with FreeNAS 11.1 and later

Integrating Let’s Encrypt TLS Certificates with FreeNAS FreeNAS has long had the ability to use HTTPS for the web GUI, but that has usually meant dealing with self-signed certificates and the associated headaches, or paying for a commercial...

www.ixsystems.com

FreeNAS 11.3 includes a little bit of this capability built-in, but only for one DNS host, IIRC.

Ok Thank you. I guess they didn't say that a self signing one wouldn't still work in the video. Thank you.

 

[danb35]

I guess they didn't say that a self signing one wouldn't still work in the video.

That depends what you mean by "work". It will still encrypt your communications, but in the four years since that video was made, browsers have become less willing to trust self-signed certs. So the cert will still work, but it's very hard to avoid certificate errors.

 

[mistermanko]

What would be the benefit of that when accsessing FreeNAS from local networks? It've read here to never expose a FN-box to the internet.

 

[danb35]

What would be the benefit of that when accsessing FreeNAS from local networks?

Browsers have gotten more, shall we say, vocal in their warnings about HTTP forms and untrusted certs, to the point where it's pretty much impossible to trust a self-signed cert and have the browser show that everything's OK. Is a cert from a trusted CA needed for secure communications on your LAN? No, but it makes matters a lot easier with the browsers.

 

[Markeyse]

That depends what you mean by "work". It will still encrypt your communications, but in the four years since that video was made, browsers have become less willing to trust self-signed certs. So the cert will still work, but it's very hard to avoid certificate errors.

Got ya!

 

[Markeyse]

What would be the benefit of that when accsessing FreeNAS from local networks? It've read here to never expose a FN-box to the internet.

For setup and stuff. My rig runs headless. Besides it is still technically local. I don't need to be connected to the net to still access it.

Browsers have gotten more, shall we say, vocal in their warnings about HTTP forms and untrusted certs, to the point where it's pretty much impossible to trust a self-signed cert and have the browser show that everything's OK. Is a cert from a trusted CA needed for secure communications on your LAN? No, but it makes matters a lot easier with the browsers.

Yea because I was like maybe I can run it and force it to go HTTPS and it will be "green" on the browser, but yet It says it isn't trusted and I have to click the link to say it is ok it isn't untrusted.

 

[SHAWN MOLLOY]

If you own a domain, the best thing to do is to get a real, trusted cert from a real CA.

Sorry I'm so late to the party but may I ask, danb35, are you saying we can re-use the CERT from an existing domain for our local truenas instace? IE, an SSL cert for MyDomain.com can be used with truenas.local just because it is trusted from a CA like NOIP? And I assume that wouldn't endanger compromise or invalidate the real domains trust in any way...

Thank you!

 

[danb35]

are you saying we can re-use the CERT from an existing domain for our local truenas instace

No, I'm saying you can make a new cert for your TrueNAS instance, using your domain name (e.g., call it truenas.domain.com). The link I gave above is still valid information for a way to do that, though acme.sh can now deploy the cert to TrueNAS directly.