How to install an SSL certificate on TrueNAS

Files you need

fullchain.pem and privkey.pem. You paste their content into the TrueNAS form.

Upload the certificate from production mode. A certificate from test mode is only for checking the process: browsers don't trust it, and some panels won't accept it at all.

Before you start

• TrueNAS can get Let's Encrypt certificates by itself and renew them automatically. It does this only with a DNS record at a few DNS providers (Cloudflare, DigitalOcean, Amazon Route 53, OVHcloud), and it needs an API key for your domain. If your domain is with one of them, the built-in feature is more convenient, because you do not have to remember to renew. Our generator is useful when another DNS provider runs your domain or when you do not want to store an API key on the NAS. In that case, confirm your domain with a DNS record: the NAS does not have to be reachable from the internet.
• The address on the certificate (for example nas.yourdomain.com) must lead to the NAS. The simplest way is an A record in your domain's DNS zone with the NAS's local IP address (for example 192.168.1.20), or the same entry in your router.

Step by step

1. Sign in to TrueNAS and open “Credentials” → “Certificates”.
2. In the “Certificates” widget, click “Import”.
3. In the “Name” field, enter a name for the certificate, for example nas-yourdomain-com. TrueNAS accepts only letters, numbers, - and _ here, so do not use dots.
4. Paste the content of the files into the two fields (see below for which file goes where). Leave “Add To Trusted Store” unticked. Leave “Passphrase” and “Confirm Passphrase” empty, because the key from our generator has no password. Click “Import”.
5. Open “System” → “General Settings” and click “Settings” in the “GUI” widget.
6. In the “GUI SSL Certificate” field, choose the new certificate and click “Save”. TrueNAS asks to restart the web service: tick “Confirm” and click “Continue”. The web interface disconnects for a moment.
7. Open the web interface at the address on your domain, for example https://nas.yourdomain.com.

What to paste into which field

• Certificate: the whole content of the fullchain.pem file (the certificate together with the intermediate certificate)
• Private Key: the whole content of the privkey.pem file

How to copy the content of a file

1. Windows: right-click the file, choose “Open with” and then “Notepad”. Mac: Control-click the file, choose “Open With” and then “TextEdit”.
2. Select all the text (Ctrl+A, on a Mac Cmd+A) and copy it (Ctrl+C, on a Mac Cmd+C).
3. In the panel, click into the field and paste (Ctrl+V, on a Mac Cmd+V). Paste everything, including the BEGIN and END lines, and don't change anything.

Checking the result

Open your website over https:// and click the padlock (or the settings icon) next to the address. The certificate details should show Let's Encrypt as the issuer and an expiry date matching the panel. If the browser still shows the old certificate, wait a few minutes and reload the page.

If you see a warning instead of your website, we explain the error codes on the page “Your connection is not private”. If the site opens over https but looks broken or something doesn't work, see mixed content. Finally, turn on the redirect from http to https so everyone lands on the secure version.

Good to know

• If TrueNAS rejects the key, check that privkey.pem and fullchain.pem come from the same order. If they do, generate the certificate again with an RSA 2048 key (step 1 of the generator, “Key type”).
• TrueNAS does not renew a certificate imported from files by itself. When it is time to renew, you import a new one (see below).
• In TrueNAS 25.04 there is an “Add” button instead of “Import”. In the wizard, set “Type” to “Import Certificate”.
• TrueNAS CORE has different menus and, according to the vendor, has reached end of life, so this guide does not cover it.

When you renew

TrueNAS does not let you replace the files of an imported certificate. Import the new certificate under a new name (for example with a date: nas-yourdomain-com-2027-01), select it in “GUI SSL Certificate” as in steps 5 and 6, then go to “Credentials” → “Certificates” and remove the old one with “Delete” in its row.

Hosting panels change from time to time. If something looks different from this guide, write to kontakt@freessl.pl and we'll update it.