Local Root CA and auto-renewed HTTPS certificates for private networks and services
with automatic deployment to Pi-hole, Technitium, and Tailscale

local-https creates a local Root CA and issues a server certificate for your machine, so you can access web UIs over HTTPS without browser warnings (after trusting the Root CA on your devices).

It can automatically deploy certificates and reload supported services:

• ✅ Pi-hole (FTL webserver or Lighttpd)
• ✅ Technitium DNS (uses a password-protected .pfx)
• ✅ Tailscale (adds your Tailscale DNS name to the certificate SANs)

It is officially supported on Debian-based distributions (Debian, Ubuntu, Raspberry Pi OS, Armbian). Other Linux distributions may work but are not officially supported.

curl -fsSL https://raw.githubusercontent.com/luizbizzio/local-https/main/install.sh | sudo bash

That installs the command to:

• /usr/local/sbin/local-https

Then it runs the setup flow (local-https --install) and offers auto-renew (systemd timer recommended).

• 🔐 Creates (or reuses) a local Root CA (rootCA.crt)
• 🪪 Issues a server certificate (default: 40 days) with SANs for:
  • hostname
  • relevant LAN IPs (filtered)
  • pi.hole when Pi-hole is detected
  • Tailscale DNS name when available
• 📦 Generates:
  • server.pem (cert + key, for services like Pi-hole)
  • server.pfx (password-protected, for services like Technitium)
• 🔁 Can enable automatic renewal via systemd timer (or cron fallback)
• 🧠 On renewal, it only “deploys/restarts” if a new cert was actually created (unless forced)

• 📅 The server certificate is issued for 40 days.
• ⏳ --renew only renews when the cert is close to expiry (default window: 7 days).
• 🧩 If you enable systemd timer, it runs daily (with randomized delay).

Check the timer:

systemctl list-timers | grep local-https
systemctl status local-https-renew.timer --no-pager

See logs:

journalctl -u local-https-renew.service -n 100 --no-pager

Force-run via systemd (without editing unit files):

sudo systemd-run --unit=local-https-renew-force --service-type=oneshot   /usr/local/sbin/local-https --renew --force-renew

• Detects Pi-hole automatically.
• Supports:
  • FTL webserver TLS (Pi-hole 6+)
  • Lighttpd TLS (older setups)
• On renew (when a new cert is created), it restarts the correct service so the new cert is used.

• If Technitium is detected, the script can configure Technitium Web UI TLS to use:
  • server.pfx + the stored password
• On renew (when a new cert is created), it restarts the Technitium service so the new cert is loaded.

• If tailscale and jq are available, the script adds your Tailscale DNS name (like host.ts.net) to the certificate SANs.

Default folder:

• /etc/ssl/servercerts

Main files:

• rootCA.crt and rootCA.key (local Root CA)
• server.crt, server.key, server.pem
• server.pfx and .pfx-pass (password file)

State:

• /var/lib/local-https/state.env

You must trust rootCA.crt on your device to avoid HTTPS warnings.

Get the certificate from the server:

• Print in terminal: sudo local-https --print-ca
• Or copy the file: /etc/ssl/servercerts/rootCA.crt

1. Copy rootCA.crt to your PC.
2. Double-click it → Install Certificate
3. Choose Local Machine
4. Put it in Trusted Root Certification Authorities
5. Reopen the browser.

1. Open Keychain Access
2. Drag rootCA.crt into System keychain
3. Open the cert → set Trust to Always Trust

1. AirDrop/email the rootCA.crt to the device, open it
2. Settings → General → VPN & Device Management → install profile
3. Settings → General → About → Certificate Trust Settings → enable full trust

1. Copy rootCA.crt to the phone
2. Settings → Security → Encryption & credentials → Install a certificate → CA certificate
3. Note: some apps ignore user-installed CAs.

sudo cp rootCA.crt /usr/local/share/ca-certificates/local-https-rootCA.crt
sudo update-ca-certificates

Public TLS Certificate Authorities and browser policies now favor shorter lifetimes (around 40–45 days) for security reasons. Our default 40-day validity matches this industry trend and avoids issues with browser trust and automated renewals. See SSL.com’s discussion on ~47-day certificates: https://www.ssl.com/article/preparing-for-47-day-ssl-tls-certificates/

• 🧱 This is a local CA. It is for your own network and devices, not public HTTPS.
• 🧪 If you are testing renew: use sudo local-https --renew --force-renew and confirm the new notAfter date with OpenSSL.
• 🔧 Pi-hole Lighttpd mode may install lighttpd-mod-openssl via apt-get.
• 🐳 Not intended for container-based TLS termination or Docker ingress setups.
• 🧷 The PFX password is stored in a root-only file. Treat it as a secret.

This repository is licensed under the MIT License