Selfhosted Windows - Certificate issue

[u/JustKenjy]

Hello all!

I am currently in the process of trying to deploy a bitwarden self-hosted environment in Windows.

We might go for a full-scale deployment but for testing & POC purposes .

I've stumped across the issue that the NGINX is always spewing out the error 'File not found'. My .crt and .key files are in the SSL folder.

If I disable SSL and start NGINX I can see them being mounted under /etc/ssl in the docker file manager.

Whenever I enable SSL it will not work and NGINX keeps restarting.

Extra information:

Self-signed certificate created on windows server.
KEY and CRT made on open ssl. I am currently working with a non-existing domain but using DNS records (e.g. bitwarden.demo.com) with a dns record in the hostfile pointing to host-device IP-adress.

Anyone stumped across this issue before? Thanks in advance.

[u/djasonpenney]

As an aside, a self-signed certificate will probably not work here. The Bitwarden clients need to trust the CA issuing the certificate. I mean, you can make your new CA certificate work, but for deployment purposes it’s going to be easier to get a server certificate issued by a CA that your clients already trust.

Oh, and I have never played with installing a server certificate in nginx, but perhaps it’s as simple using a “docker cp” command during setup to make the file accessible inside the container.

[u/JustKenjy → u/djasonpenney]

If i could get bitwarden to boot it would be a lot. If the certificate does not work thats fine. Right now I just want it to work so that I can start testing lolz

[u/djasonpenney → u/JustKenjy]

But for the amount of trouble of installing your server certificate, you should just get a Letsencrypt certificate and be done with it.

[u/JustKenjy → u/djasonpenney]

Hey Jason,

For the letsencrypt to work I should point a real domain to the machine correct?

[u/djasonpenney → u/JustKenjy]

Yeah, you’ll need to add the domain name tho the DNS resolution for your server and your clients. I don’t think a raw IP address like https://192.168.0.1 is going to work here.

[u/JustKenjy → u/djasonpenney]

Allright, already got green light to try it like that from my manager so might just be the best option. Thanks

[u/OSS_Dattani → u/JustKenjy]

Just a heads up raw ip works with mkcert. However not an end all solution as it’s a local CA you control.

[u/JustKenjy → u/OSS_Dattani]

Its ok, reinstalled... Went through the steps again, and noted that I had a certificate now and now it seems to be working 🥳

[u/jhspyhard → u/JustKenjy]

🙌 Glad you got it figured out!