Where does the cert download to on Linux?

[animalrap]

Hi, really appreciate this tool. I got it installed using SSH and tailscale. Secure connection now from my Macbook. Wondering how I install the cert on the Linux machine I'm running pihole on now. I don't see it in my download folder. Where would it be downloaded?

[luizbizzio]

The certificate was sent directly to Pi-hole, not to Mac. It is located in /etc/ssl/mycerts/ and will also be copied to http://<PIHOLE_IP>/admin/hostname.crt. Just download this .crt and import it to the system (macOS on Keychain, Linux on /usr/local/share/ca-certificates/). :)

[animalrap]

Debian bookworm. I checked Chromium as well and it said not secure as well. I also made sure to the run the sudo update-ca-certificates as well.

[luizbizzio]

Here "/usr/local/share/ca-certificates/"?

[animalrap]

Yes.

[luizbizzio]

Update for current versions of local-https

The information above is outdated for the current version of local-https.

The certificates are now stored in:

/etc/ssl/servercerts

The certificate that should be installed on your client devices is:

/etc/ssl/servercerts/rootCA.crt

rootCA.crt is the local Certificate Authority that signs the server certificate. You should trust this certificate on your devices.

Do not install server.crt, server.pem, or server.pfx as a Trusted Root CA. Those are server certificate files used by services such as Pi-hole and Technitium.

You can also print the Root CA directly with:

sudo local-https --print-ca

Debian / Ubuntu

Copy rootCA.crt to the client machine and run:

sudo cp rootCA.crt /usr/local/share/ca-certificates/local-https-rootCA.crt
sudo update-ca-certificates

Then restart the browser.

You do not need to install the Root CA on the machine running Pi-hole just for Pi-hole HTTPS itself. It needs to be trusted by the devices and browsers that access the HTTPS page.

If the browser still reports the connection as insecure, check that you are accessing Pi-hole using a hostname or IP address included in the certificate.

With current versions of local-https, the certificate automatically includes the machine hostname, the configured local domain, relevant LAN IP addresses, and the Tailscale DNS name when available.