How to install an SSL certificate on an Unraid server

Files you need

fullchain.pem and privkey.pem. You combine them into one file on the server. Generate the certificate for servername.yourdomain.com (for example tower.yourdomain.com) or as a wildcard for *.yourdomain.com.

Upload the certificate from production mode. A certificate from test mode is only for checking the process: browsers don't trust it, and some panels won't accept it at all.

Before you start

• Unraid can get a free Let's Encrypt certificate by itself with the “Provision” button in “Settings” → “Management Access”, and it renews it automatically. That certificate only works at a long address in the myunraid.net domain (for example https://192-168-100-1.a1b2c3d4e5.myunraid.net). Our generator is useful when you want to open the server at an address on your own domain. In that case, confirm your domain with a DNS record: the server does not have to be reachable from the internet, and a wildcard certificate fits any server name.
• Unraid only accepts a certificate for servername.yourdomain.com or *.yourdomain.com, where yourdomain.com is exactly what you enter in the “Local TLD” field. Unraid deletes any other certificate and goes back to its own certificate, which makes the browser show a warning. You can check the server name in “Settings” → “Identification”, in the “Server name” field.
• The address (for example tower.yourdomain.com) must lead to the server. The simplest way is an A record in your domain's DNS zone with the server's local IP address (for example 192.168.1.20), or the same entry in your router.

Step by step

1. Open “Settings” → “Management Access”. In the “Local TLD” field, enter your domain (for example yourdomain.com), set “Use SSL/TLS” to “Yes” and click “Apply”. The browser may now show a certificate warning. This is still Unraid's own certificate, so continue.
2. Open the file manager in the certificate folder: in the browser's address bar, add /Main/Browse?dir=/boot/config/ssl/certs to the address of the web interface, for example https://192.168.1.20/Main/Browse?dir=/boot/config/ssl/certs.
3. Click “Upload” below the file list and select the fullchain.pem file. Upload privkey.pem the same way.
4. Open the terminal: in the top-right corner of the web interface, select “>_”. Paste the commands below and press Enter:

   cd /boot/config/ssl/certs
   cat fullchain.pem privkey.pem > "$(hostname)_unraid_bundle.pem"
   rm fullchain.pem privkey.pem
   /etc/rc.d/rc.nginx reload

   The commands combine both files into one with the name Unraid expects, remove the separate copies and reload the Unraid web server. Instead of the last command, you can also restart the server.
5. Open the web interface at https://servername.yourdomain.com (for example https://tower.yourdomain.com). In “Settings” → “Management Access”, “Certificate issuer” should show Let's Encrypt and “Certificate expiration” the new expiry date.

Checking the result

Open your website over https:// and click the padlock (or the settings icon) next to the address. The certificate details should show Let's Encrypt as the issuer and an expiry date matching the panel. If the browser still shows the old certificate, wait a few minutes and reload the page.

If you see a warning instead of your website, we explain the error codes on the page “Your connection is not private”. If the site opens over https but looks broken or something doesn't work, see mixed content. Finally, turn on the redirect from http to https so everyone lands on the secure version.

Good to know

• If the browser still shows a warning and “Certificate issuer” does not show Let's Encrypt, Unraid deleted the certificate because it did not match the server name and the “Local TLD” field. Generate a certificate for the right address and repeat steps 2 to 4.
• If you change the server name or “Local TLD”, Unraid creates a new certificate of its own in place of yours. Upload your certificate again.
• The certificate file contains the private key. If the boot device is shared on the network, Unraid recommends access only for trusted users or turning the share off.
• Unraid does not renew a certificate uploaded from files by itself. When it is time to renew, you upload a new one (see below).

When you renew

Repeat steps 2 to 4: upload the new fullchain.pem and privkey.pem to /boot/config/ssl/certs and paste the same commands in the terminal. The new file replaces the old one.

Hosting panels change from time to time. If something looks different from this guide, write to kontakt@freessl.pl and we'll update it.