Add TLS certificate guides for Pi-hole - #1278
Conversation
✅ Deploy Preview for pihole-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
c042d84 to
4fd65ff
Compare
- Add automatic SSL certificate renewal guide using acme.sh + Let's Encrypt * Covers Cloudflare DNS validation setup * Includes certificate installation and Pi-hole configuration * Documents automatic renewal via cron jobs - Add self-signed SSL certificate creation guide * Method 1: Internal CA approach for multiple servers (recommended) * Method 2: Direct self-signed certificates for single server * Includes Subject Alternative Names (SAN) configuration * Covers browser certificate installation steps These guides are adapted from my existing GitHub Gists: - Automatic renewal: https://gist.github.com/kaczmar2/17f02a0ddb59a7d336b20376695797c6 - Self-signed certs: https://gist.github.com/kaczmar2/e1b5eb635c1a1e792faf36508c5698ee Both guides provide step-by-step instructions for different deployment scenarios. Fix Pi-hole branding in new guides. Signed-off-by: Christian Kaczmarek <kaczmar2@outlook.com>
Signed-off-by: Christian Kaczmarek <kaczmar2@outlook.com>
- Remove external Gist links and embed cert.cnf template inline - Fix typo: 'mahcine' -> 'machine' Signed-off-by: Christian Kaczmarek <kaczmar2@outlook.com>
4fd65ff to
45553ce
Compare
|
Updated the branch with the latest master and verified the preview. All previous feedback has been addressed and the checks are passing. Ready for a final review and merge. |
|
Thanks for addressing the review comments. I'm a bit hesitating if we should publish the part about automatic certificate renewal, as it suggest that your Pi-hole should have a public reachable domain (for the DNS challange to work). But this is something we don't want, because this turns Pi-hole easily into an open resolver which we strongly reject. |
Per review feedback, drop the acme.sh/Let's Encrypt renewal guide: the official docs should not suggest pairing Pi-hole with a public domain. The self-signed certificate guide is unaffected. Signed-off-by: Christian Kaczmarek <kaczmar2@outlook.com>
The signing example reused tls.csr from the first certificate instead of the tls2.csr generated in the previous command. Signed-off-by: Christian Kaczmarek <kaczmar2@outlook.com>
…uides Signed-off-by: Christian Kaczmarek <kaczmar2@outlook.com>
|
This very much reminds me of #1379 (reverse proxy/nginx guide), which was closed because it wasn't that much Pi-hole specific. |
That's a fair point — I agree the automatic renewal guide doesn't belong in the official docs. I've removed the automatic renewal page from the PR, so it's now just the self-signed certificate guide plus a small typo fix I caught in the "issuing additional certificates" section. Ready for another look. |
|
This pull request has conflicts, please resolve those before we can evaluate the pull request. |
|
@darkexplosiveqwx - having gone back through it, you're right. Most of this is generic certificate creation with openssl. Anyone bringing their own certificate is likely already comfortable with the openssl side. Closing this. Thanks @yubiuser and @darkexplosiveqwx for taking the time to review it. |
3 participants
What does this PR aim to accomplish?:
This PR adds comprehensive SSL certificate configuration guides for Pi-hole users who need alternatives to the default self-signed certificate.
How does this PR accomplish the above?:
Adds two detailed guides under docs/guides/ssl/:
Both guides provide step-by-step instructions with troubleshooting.
Link documentation PRs if any are needed to support this PR:
N/A
By submitting this pull request, I confirm the following:
git rebase)