mTLS for Self-Hosted Services: Client Certificates Explained
Mutual TLS (mTLS) turns a certificate into a login: the client must present a certificate your server trusts, or the…
Category: Internal PKI & HTTPS
Internal certificate authorities, TLS certificates, and HTTPS for self-hosted homelab services.
ACME on OPNsense: Free Certs for the Firewall Web UI
OPNsense has an ACME Client plugin that fetches a free Let’s Encrypt certificate for the firewall’s own web UI and…
Caddy vs Traefik vs Nginx Proxy Manager for Automatic HTTPS
For automatic HTTPS in a homelab, Caddy is the easiest, Traefik is the best fit if your services are Docker…
Trusting Your Own CA on Phones, Laptops, and Browsers
To trust your own certificate authority you install its root certificate into each device’s trust store — and the catch…
Running Your Own Internal Certificate Authority With step-ca
Running your own certificate authority with step-ca gives you an ACME server you fully control — the same automated workflow…
Let’s Encrypt Wildcard Certs With DNS-01 for Internal Services
A Let’s Encrypt wildcard certificate lets one *.home.example.com certificate cover every internal service you run, and the DNS-01 challenge is…
Why a Public Domain Beats .local for Homelab HTTPS
Use a real public domain — a subdomain like home.example.com — for your homelab, not .local. A registered domain gives…
Homelab Internal HTTPS Certificates: The Complete Guide
Real HTTPS for a homelab means every internal service loads with a green padlock and no browser warning — and…