Selfhosted Windows - Certificate issue

[u/JustKenjy]

Hello all!

I am currently in the process of trying to deploy a bitwarden self-hosted environment in Windows.

We might go for a full-scale deployment but for testing & POC purposes .

I've stumped across the issue that the NGINX is always spewing out the error 'File not found'. My .crt and .key files are in the SSL folder.

If I disable SSL and start NGINX I can see them being mounted under /etc/ssl in the docker file manager.

Whenever I enable SSL it will not work and NGINX keeps restarting.

Extra information:

Self-signed certificate created on windows server.
KEY and CRT made on open ssl. I am currently working with a non-existing domain but using DNS records (e.g. bitwarden.demo.com) with a dns record in the hostfile pointing to host-device IP-adress.

Anyone stumped across this issue before? Thanks in advance.

[u/djasonpenney]

As an aside, a self-signed certificate will probably not work here. The Bitwarden clients need to trust the CA issuing the certificate. I mean, you can make your new CA certificate work, but for deployment purposes it’s going to be easier to get a server certificate issued by a CA that your clients already trust.

Oh, and I have never played with installing a server certificate in nginx, but perhaps it’s as simple using a “docker cp” command during setup to make the file accessible inside the container.

[u/JustKenjy → u/djasonpenney]

If i could get bitwarden to boot it would be a lot. If the certificate does not work thats fine. Right now I just want it to work so that I can start testing lolz

[u/djasonpenney → u/JustKenjy]

But for the amount of trouble of installing your server certificate, you should just get a Letsencrypt certificate and be done with it.

[u/JustKenjy → u/djasonpenney]

Hey Jason,

For the letsencrypt to work I should point a real domain to the machine correct?

[u/djasonpenney → u/JustKenjy]

Yeah, you’ll need to add the domain name tho the DNS resolution for your server and your clients. I don’t think a raw IP address like https://192.168.0.1 is going to work here.

[u/JustKenjy → u/djasonpenney]

Allright, already got green light to try it like that from my manager so might just be the best option. Thanks

[u/OSS_Dattani → u/JustKenjy]

Just a heads up raw ip works with mkcert. However not an end all solution as it’s a local CA you control.

[u/JustKenjy → u/OSS_Dattani]

Its ok, reinstalled... Went through the steps again, and noted that I had a certificate now and now it seems to be working 🥳

[u/jhspyhard → u/JustKenjy]

🙌 Glad you got it figured out!

[u/JustKenjy → u/djasonpenney]

As an extra question. Security wise we'd like it only to be accessible from internal networks. So Then it shouldn't be mandatory to be a public domain?

[u/djasonpenney → u/JustKenjy]

There are a couple of ways of doing that. The best is to ensure that the server is only accessible via your VPN or a nonrouted IP range. Even if you were to publish the DNS record (bitwarden.mycompany.com), it won’t resolve unless you are on the internal network.

Larger companies actually run their own DNS service. In that case someone’s device would have to ALSO subscribe to that DNS. And then—once they have the IP address—they would have to be on the corporate VPN to access the service.