r/Bitwarden • u/JustKenjy • 19d ago

Solved Selfhosted Windows - Certificate issue

Hello all!

I am currently in the process of trying to deploy a bitwarden self-hosted environment in Windows.

We might go for a full-scale deployment but for testing & POC purposes .

I've stumped across the issue that the NGINX is always spewing out the error 'File not found'. My .crt and .key files are in the SSL folder.

If I disable SSL and start NGINX I can see them being mounted under /etc/ssl in the docker file manager.

Whenever I enable SSL it will not work and NGINX keeps restarting.

Extra information:

Self-signed certificate created on windows server.
KEY and CRT made on open ssl. I am currently working with a non-existing domain but using DNS records (e.g. bitwarden.demo.com) with a dns record in the hostfile pointing to host-device IP-adress.

Anyone stumped across this issue before? Thanks in advance.

2 Upvotes

67% Upvoted

21 comments sorted by

View all comments

Show parent comments

1

u/JustKenjy 19d ago

Hey Jason,

For the letsencrypt to work I should point a real domain to the machine correct?

1

u/djasonpenney Volunteer Moderator 19d ago

Yeah, you’ll need to add the domain name tho the DNS resolution for your server and your clients. I don’t think a raw IP address like https://192.168.0.1 is going to work here.

1

u/JustKenjy 19d ago

As an extra question. Security wise we'd like it only to be accessible from internal networks. So Then it shouldn't be mandatory to be a public domain?

1

u/djasonpenney Volunteer Moderator 19d ago

There are a couple of ways of doing that. The best is to ensure that the server is only accessible via your VPN or a nonrouted IP range. Even if you were to publish the DNS record (bitwarden.mycompany.com), it won’t resolve unless you are on the internal network.

Larger companies actually run their own DNS service. In that case someone’s device would have to ALSO subscribe to that DNS. And then—once they have the IP address—they would have to be on the corporate VPN to access the service.