# Https with an extern certificate

**URL:** <https://discourse.nodered.org/t/https-with-an-extern-certificate/78183>\
**Category:** General\
**Created:** [4 May 2023 12:16 UTC](https://discourse.nodered.org/t/https-with-an-extern-certificate/78183 "2023-05-04T12:16:17Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Manuel\_o](https://avatars.discourse-cdn.com/v4/letter/m/977dab/32.png) [@Manuel\_o](https://discourse.nodered.org/u/Manuel_o)\
**Post date:** [4 May 2023 12:16 UTC](https://discourse.nodered.org/t/https-with-an-extern-certificate/78183/1 "2023-05-04T12:16:17Z")

</div>

Hello.

I am testing the https of node red.

I followed the instructions to implement a selft signt certificate. Worked so far.  
I created the key.pem and the cert.pem and added the path in my settings.js.

But now i have this ugly "self cert" problem, that my brower reminds me, when i first visit my dashboard, that its not secure and so on.

Is there a way to change that?

Thank you

edit: i am owning an URL. There i can request a cert. But can i use this cert to solve my problem?

---

<div class="post-metadata">

**Author:** ![Shan](https://avatars.discourse-cdn.com/v4/letter/s/7ab992/32.png) [@Shan](https://discourse.nodered.org/u/Shan)\
**Post date:** [4 May 2023 13:05 UTC](https://discourse.nodered.org/t/https-with-an-extern-certificate/78183/2 "2023-05-04T13:05:48Z")

</div>

You can create a Certificate Authority sign this "ugly" certificate and update your CA-certificates on your browser and it will avoid the browser error

Or if you want to use it use LetsEncrypt.

---

<div class="post-metadata">

**Author:** ![Manuel\_o](https://avatars.discourse-cdn.com/v4/letter/m/977dab/32.png) [@Manuel\_o](https://discourse.nodered.org/u/Manuel_o)\
**Post date:** [4 May 2023 14:19 UTC](https://discourse.nodered.org/t/https-with-an-extern-certificate/78183/3 "2023-05-04T14:19:03Z")

</div>

thank you for your answer.

but will the problem not remain, when someone else will login (from another browser)?

I would want a solution, that everyone can visit the dashboard without the warning from the browser and a "normal" secure look like a regular homepage.

I hope it is clear what i mean

best regards

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [4 May 2023 17:28 UTC](https://discourse.nodered.org/t/https-with-an-extern-certificate/78183/4 "2023-05-04T17:28:54Z")

</div>

> [@Manuel\_o](#):
>
> but will the problem not remain, when someone else will login (from another browser)?

There are two ways to fix the issue:

1. Distribute your trusted root cert to all browsers and systems that need it
2. Get a certificate signed by a pre-trusted root authority.

#2 is, these days, much easier than #1. However, you need a DNS (sub)domain. With that, you can use the free Let's Encrypt service. To use it, you either need a DNS that you (or your IT dept.) have control over (to add a TXT record to) or you need to open a port 80 connection to the server that will be managing the certificate updates.

---

<div class="post-metadata">

**Author:** ![Manuel\_o](https://avatars.discourse-cdn.com/v4/letter/m/977dab/32.png) [@Manuel\_o](https://discourse.nodered.org/u/Manuel_o)\
**Post date:** [7 May 2023 19:12 UTC](https://discourse.nodered.org/t/https-with-an-extern-certificate/78183/5 "2023-05-07T19:12:44Z")

</div>

Thank you for the answer.

If i understand your point 2 correct, i already tried it. I am owner of an URL. Lets say [example.com](http://example.com). From this out i created a subdomane lets say: [nodered.example.com](http://nodered.example.com) (txt record). This subdomane is ssl secured and points to the ip of my VM where node red is running.

Problem right now: i can only point to the ip and not ports.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [7 May 2023 20:03 UTC](https://discourse.nodered.org/t/https-with-an-extern-certificate/78183/6 "2023-05-07T20:03:27Z")

</div>

> [@Manuel\_o](#):
>
> Problem right now: i can only point to the ip and not ports.

Not sure I understand. This was not your original question was it?

What do you mean by "point to the ip"? With what, how? You shouldn't need to deal with the IP address except in your DNS entry. With the exception that you might have some edge security which NAT's external to internal addresses. But again that is simply a router or firewall config.

Access to Ports are also controlled via your router/firewall but you can also use a proxy server to hide ports using port mapping (typically your proxy takes a request on port 443 and redirects it to the internal address and port),

---

<div class="post-metadata">

**Author:** ![lu4t](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/lu4t/32/32276_2.png) [@lu4t](https://discourse.nodered.org/u/lu4t)\
**Post date:** [15 May 2023 22:33 UTC](https://discourse.nodered.org/t/https-with-an-extern-certificate/78183/7 "2023-05-15T22:33:01Z")

</div>

if you want to expose the node-red dashboard to the outside world over a https connection, and you already own a domain, you can use the method explained on this post:

> [@Free and SSL secured access to your node-red instance running on a Raspberry Pi](https://discourse.nodered.org/t/free-and-ssl-secured-access-to-your-node-red-instance-running-on-a-raspberry-pi/64112):
>
> Some months back, I published a video showing how to use cloudflare tunnels to access node-red running on a Synology NAS. I told @cymplecy on this [post](https://discourse.nodered.org/t/remote-free-and-secure-access-to-your-node-red-instance-at-home/60353) I would grab my old RPi and record a video showing how to get the same result if node-red was running on a RPi as a host. Well, this is the result of the "promise" I did. Hoping the community can take advantage of it also: [[HOW TO: Remote access a Raspberry Pi using a Cloudflare tunnel (node-red and ssh).] ](https://www.youtube.com/watch?v=Z6b3l1z0N7w) Take care! …

The cloudflare account that allows to do this is free (even if your register is not cloudflare).

---

<div class="post-metadata">

**Author:** ![Manuel\_o](https://avatars.discourse-cdn.com/v4/letter/m/977dab/32.png) [@Manuel\_o](https://discourse.nodered.org/u/Manuel_o)\
**Post date:** [17 May 2023 12:53 UTC](https://discourse.nodered.org/t/https-with-an-extern-certificate/78183/8 "2023-05-17T12:53:28Z")

</div>

I apologize if my previous question was not specific enough. Allow me to explain my issue once again:

I currently have a Linux virtual machine (VM) on which my NODE-RED instance is running to control my pump. The instance can be accessed via the following example URL: [http://10.122.xx.xx:1880/ui](http://10.122.xx.xx:1880/ui). Initially, it was only accessible via HTTP.

Subsequently, I attempted to implement a self-signed SSL certificate by following this guide: [https://stevesnoderedguide.com/securing-node-red-ssl](https://stevesnoderedguide.com/securing-node-red-ssl). As a result, anyone (including myself) attempting to visit the instance now needs to use HTTPS.

However, all web browsers perceive the site as a potential security risk, requiring me to click through various warnings and accept the associated risks. I am seeking a solution to eliminate these warnings.

I own a domain name, let's say "test.industries," and through my hosting provider, I can configure DNS management settings for this domain. Here lies the problem: I can create a DNS record for, let's say, "nodered.test.industries" (secured with SSL), which points to the IP address of my VM (10.122.xx.xx). However, I encounter an issue where I can only specify the IP address of my VM and not the ":1880/ui" part. Consequently, the IP address (10.122.xx.xx) is SSL secured, but the specific endpoint (10.122.xx.xx:1880/ui) is not.

I apologize if my questions appear foolish; I genuinely strive to resolve this matter.

Thank you for your understanding and best regards.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [17 May 2023 13:20 UTC](https://discourse.nodered.org/t/https-with-an-extern-certificate/78183/9 "2023-05-17T13:20:00Z")

</div>

> [@Manuel\_o](#):
>
> I apologize if my questions appear foolish

No need, there are no foolish questions, only foolish answers 🙂

To use a TLS certificate that is recognised by browsers with any service, you need to be using a domain NAME and not an IP ADDRESS. So you have obtained a certificate but now you need to make sure that everyone can reference the endpoints using a name. While your external DNS provider does this for public use, that does not help for local private use.

You typically have a couple of ways to enable a public DNS name to be used internally - and remember, the internal use needs to direct to the internal IP whereas the public DNS points to a public IP.

You may be able to set up your Router to provide this service. You would need to make sure all end-user devices use the Router as their DNS "provider" though. In my case, I have a Ubiquity EdgeRouter Lite which allows something called "Hairpin NAT" which allows its built-in DNS service to recognise an internal IP when using a name internally. Various routers may call that slightly differently but that is basically the approach.

The other alternative would be to manually configure every users device using the `HOSTS` file (I don't think that will work on mobile devices though). There are plenty of articles describing how to do that so I won't repeat it here.

* * *

For other people reading this thread who haven't obtained a certificate, I found this site which is interesting as they've created a shared certificate for anyone to use. Obviously should only ever be used for testing as it certainly isn't secure but could be useful.

[Upinel/localhost.direct: localhost with public CA signed SSL certificate (github.com)](https://github.com/Upinel/localhost.direct)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [16 July 2023 13:21 UTC](https://discourse.nodered.org/t/https-with-an-extern-certificate/78183/10 "2023-07-16T13:21:00Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.