TLS certificate builder
Private CA + server certificate for the on-prem box, with the SANs, extensions and validity browsers actually accept. Back to the portal
Everything runs in your browser. Keys are generated with WebCrypto on this page and are never sent anywhere — the download buttons below are the only way they leave it.
1. Server names
825 days is the maximum Apple platforms accept. Entries that look like IP addresses automatically become IP SANs — a DNS SAN holding an IP is one of the classic silent-failure mistakes this page exists to prevent.
2. Certificate authority
Select the CA files from the previous run. The CA is reused so client machines keep trusting the new server certificate without changes.
The CA is valid 10 years and is what client
machines install (once). Keep llmedi-ca.key safe — it is only needed
again for renewals.
3. Generate
Download all files and
store them in the certs/ directory next to the box's
docker-compose.yml. (Renewal: only
tls.crt and tls.key changed — replace those two.)
4. Installing
- In the box's
.envset (HTTPS Option 3):CADDY_TLS=/certs/tls.crt /certs/tls.key SERVER_HOST=… - Apply:
docker compose up -d caddy(or restart it). - Install
llmedi-ca.crton every client machine (once):Windows: certutil -addstore -f ROOT llmedi-ca.crt (or push via GPO/MDM) macOS: Keychain Access → System → import → set to "Always Trust" Linux: cp llmedi-ca.crt /usr/local/share/ca-certificates/ && update-ca-certificates Firefox: trusts its OWN store → Settings → Certificates → Import
- Verify from a client:
curl --cacert llmedi-ca.crt https://…/
Renewal (before …):
come back to this page, choose "Renewal", upload llmedi-ca.crt +
llmedi-ca.key, and replace tls.crt/tls.key on
the box — clients need no changes. Then: docker compose restart caddy