How to install an SSL certificate on an OpenMediaVault NAS

Files you need

privkey.pem and fullchain.pem. You paste their contents into a form. OpenMediaVault accepts RSA and ECDSA keys (called ECC in the interface), so you can leave the key type in the generator as it is.

Upload the certificate from production mode. A certificate from test mode is only for checking the process: browsers don't trust it, and some panels won't accept it at all.

Before you start

• The OpenMediaVault documentation does not describe getting Let's Encrypt certificates by itself, only importing ready-made files. So you upload the certificate by hand and renew it by hand.
• The easiest way to confirm your domain is a DNS record (the “DNS record” method in the generator). The NAS then does not need to be reachable from the internet, and you do not open any port on your router.

Step by step

1. Sign in to the OpenMediaVault web interface and open “System” → “Certificates” → “SSL”.
2. Click the add button (tooltip “Create | Import”) and choose “Import”.
3. Paste the file contents into the fields (see below for what goes where). In the “Tags” field, type a short name, for example your domain name. Click “Import”.
4. Open “System” → “Workbench” → “Settings”. In version 7, the settings are directly under “System” → “Workbench”.
5. In the “Secure connection” part, tick “SSL/TLS enabled”. In the “Certificate” field, select the certificate you imported, and leave the port at 443. Click “Save”.
6. A “Pending configuration changes” bar appears at the top of the page. Click its “Apply” button and confirm. The interface restarts and may show errors for a moment. According to the documentation, you can ignore them.
7. Open the interface at https://nas.yourdomain.com and check the padlock in your browser. Once everything works, you can tick “Force SSL/TLS” in the same settings, so the interface only works over https.

What to paste into which field

• Private key: the entire contents of the privkey.pem file
• Certificate: the entire contents of the fullchain.pem file. According to the documentation, OpenMediaVault accepts this file without any conversion.
• Tags: any short name, for example your domain name. This field is required.

How to copy the content of a file

1. Windows: right-click the file, choose “Open with” and then “Notepad”. Mac: Control-click the file, choose “Open With” and then “TextEdit”.
2. Select all the text (Ctrl+A, on a Mac Cmd+A) and copy it (Ctrl+C, on a Mac Cmd+C).
3. In the panel, click into the field and paste (Ctrl+V, on a Mac Cmd+V). Paste everything, including the BEGIN and END lines, and don't change anything.

Checking the result

Open your website over https:// and click the padlock (or the settings icon) next to the address. The certificate details should show Let's Encrypt as the issuer and an expiry date matching the panel. If the browser still shows the old certificate, wait a few minutes and reload the page.

If you see a warning instead of your website, we explain the error codes on the page “Your connection is not private”. If the site opens over https but looks broken or something doesn't work, see mixed content. Finally, turn on the redirect from http to https so everyone lands on the secure version.

Good to know

• OpenMediaVault checks that the key matches the certificate. Files from two different orders will be rejected.
• You can also select the same certificate in the FTP server settings, if you use it.
• A certificate that is selected in the settings cannot be deleted. Select another one first, then delete the old one.

When you renew

You cannot edit an existing certificate, so you import a new one: steps 1 to 3, with a new name in “Tags”. Then in “Workbench” → “Settings”, select the new certificate in the “Certificate” field, click “Save” and apply the changes (“Apply”). Finally, in “System” → “Certificates” → “SSL”, select the old certificate and delete it. OpenMediaVault will not renew the certificate by itself, so keep an eye on the date (we will remind you by email).

Hosting panels change from time to time. If something looks different from this guide, write to kontakt@freessl.pl and we'll update it.