SSL Setup

Guide: SSL / TLS Setup

ɳSelf manages TLS certificates through Nginx. Three certificate modes are supported.

Self-Signed Certificates (Default)

ɳSelf auto-generates a self-signed certificate when you first run nself build. This is appropriate for local development and internal networks.

nself ssl status    # check certificate details and expiry

Browsers will show a security warning for self-signed certs, expected behaviour for local dev.

Custom Certificate Installation

If you have a certificate from a commercial CA (DigiCert, Sectigo, etc.):

Place your files on the server:

/etc/ssl/certs/nself/cert.pem      # full chain certificate
/etc/ssl/certs/nself/key.pem       # private key

Set paths in your .env.prod:

SSL_CERT_PATH=/etc/ssl/certs/nself/cert.pem
SSL_KEY_PATH=/etc/ssl/certs/nself/key.pem

Rebuild and restart:
Terminal window
```
nself build && nself restart
```

Let’s Encrypt (Manual)

Automated ACME certificate renewal via nself ssl is available in v1.1.0. If you prefer manual control, use certbot directly:

# Install certbot
apt install certbot

# Stop nginx temporarily
nself stop

# Request certificate
certbot certonly --standalone -d example.com -d '*.example.com'

# Certificates are written to /etc/letsencrypt/live/example.com/
# Copy to nSelf paths:
cp /etc/letsencrypt/live/example.com/fullchain.pem /etc/ssl/certs/nself/cert.pem
cp /etc/letsencrypt/live/example.com/privkey.pem   /etc/ssl/certs/nself/key.pem

# Restart
nself start

Note: For fully automated certificate management, use nself ssl (available in v1.1.0+).

SSL Commands

Command	Description
`nself ssl status`	Show certificate path, issuer, and expiry date
`nself ssl renew`	Trigger manual certificate renewal prompt