[GH-ISSUE #95] Feature Request: Support internal CA #1993

New issue

Closed

opened 2026-03-14 02:00:10 +03:00 by kerem · 4 comments

kerem commented

2026-03-14 02:00:10 +03:00

Owner

Originally created by @meyerje on GitHub (Sep 8, 2020).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/95

Originally assigned to: @sadnub on GitHub.

We are deploying this behind a firewall and VPN using our domain certificate authority. To enable this I made the below modifications to the install script and am wondering if these can be leveraged moving forward with install.sh and update.sh?

Change line 101 to =true to force BEHIND_NAT (probably not necessary)
BEHIND_NAT=true

Comment out lines 122 - 126 to bypass Lets Encrypt

#sudo certbot certonly --manual -d *.${rootdomain} --agree-tos --no-bootstrap --manual-public-ip-logging-ok --preferred-challenges dns -m ${letsemail} --no-eff-email
#while [[ $? -ne 0 ]]
#do
#sudo certbot certonly --manual -d *.${rootdomain} --agree-tos --no-bootstrap --manual-public-ip-logging-ok --preferred-challenges dns -m ${letsemail} --no-eff-email
#done

And then changed each section of the nginx configurations to point to the certificates we got from our CA for the server. The certificates must be staged before running the installer script. Replace each instance of:

ssl_certificate /etc/letsencrypt/live/${rootdomain}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${rootdomain}/privkey.pem;

With:

ssl_certificate /etc/ssl/certs/caissued.pem;
ssl_certificate_key /etc/ssl/private/privkey.pem;

Originally created by @meyerje on GitHub (Sep 8, 2020). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/95 Originally assigned to: @sadnub on GitHub. We are deploying this behind a firewall and VPN using our domain certificate authority. To enable this I made the below modifications to the install script and am wondering if these can be leveraged moving forward with install.sh and update.sh? Change line 101 to =true to force BEHIND_NAT (probably not necessary) `BEHIND_NAT=true` Comment out lines 122 - 126 to bypass Lets Encrypt ``` #sudo certbot certonly --manual -d *.${rootdomain} --agree-tos --no-bootstrap --manual-public-ip-logging-ok --preferred-challenges dns -m ${letsemail} --no-eff-email #while [[ $? -ne 0 ]] #do #sudo certbot certonly --manual -d *.${rootdomain} --agree-tos --no-bootstrap --manual-public-ip-logging-ok --preferred-challenges dns -m ${letsemail} --no-eff-email #done ``` And then changed each section of the nginx configurations to point to the certificates we got from our CA for the server. The certificates must be staged before running the installer script. Replace each instance of: ``` ssl_certificate /etc/letsencrypt/live/${rootdomain}/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/${rootdomain}/privkey.pem; ``` With: ``` ssl_certificate /etc/ssl/certs/caissued.pem; ssl_certificate_key /etc/ssl/private/privkey.pem; ```

kerem

2026-03-14 02:00:10 +03:00

closed this issue
added the
enhancement
label

kerem commented

2026-03-14 02:00:26 +03:00

Author

Owner

@sadnub commented on GitHub (Sep 9, 2020):

@wh1te909 I was thinking more about this and we can allow updating certificates through the UI. We could also allow completing the letsencrypt setup in the UI as well. The reverse proxy can just fallback to self-signed certs if none are present. Let me know if this sounds good and I can implement it.

@sadnub commented on GitHub (Sep 9, 2020): @wh1te909 I was thinking more about this and we can allow updating certificates through the UI. We could also allow completing the letsencrypt setup in the UI as well. The reverse proxy can just fallback to self-signed certs if none are present. Let me know if this sounds good and I can implement it.

kerem commented

2026-03-14 02:00:31 +03:00

Author

Owner

@meyerje commented on GitHub (Sep 9, 2020):

That'd be great. I noticed the four Let's Encrypt lines in the install.sh file will loop indefinitely if the commands fail so we may have to account for at least that.

@meyerje commented on GitHub (Sep 9, 2020): That'd be great. I noticed the four Let's Encrypt lines in the install.sh file will loop indefinitely if the commands fail so we may have to account for at least that.

kerem commented

2026-03-14 02:00:36 +03:00

Author

Owner

@sadnub commented on GitHub (Oct 18, 2020):

@meyerje I added #140 to remove the Let's Encrypt dependency from the install script. If you opt out of Let's Encrypt, it will create a self signed certificate. You can replace the self-signed certificate with your internal CA certs and restart nginx. I added a section to the readme also.

@sadnub commented on GitHub (Oct 18, 2020): @meyerje I added #140 to remove the Let's Encrypt dependency from the install script. If you opt out of Let's Encrypt, it will create a self signed certificate. You can replace the self-signed certificate with your internal CA certs and restart nginx. I added a section to the readme also.

kerem commented

2026-03-14 02:00:41 +03:00

Author

Owner

@wh1te909 commented on GitHub (Oct 18, 2020):

merged

@wh1te909 commented on GitHub (Oct 18, 2020): merged

kerem referenced this issue

2026-03-14 06:49:30 +03:00

[GH-ISSUE #1993] Feature Request: Improve Notes display #3191