I’m running Goldeneye 10.25.7 in a home network without any problems. Recently I got an alert that “Certificate ‘truenas_self’ is expiring”. I’ve done a lot of searching and reading, but it is still not clear to me whether this will be a problem when it does.
The Documentation Hub says “TrueNAS comes equipped with an internal, self-signed certificate”, but does not say anything about what happens when it expires.
It seems that creating and handling of certificates has changed and much of what I find online is out of date. Directions on how to create a new certificate seem overly complicated. I do not have my own domain, do not want to get involved with Cloudflare/Let’s Encrypt/DNS providers/Connect. I run my own DNS on my network using Technitium on an old Raspberry Pi.
A self signed certificate will be adequate for me. Do I need to take any action?
You’re already getting certificate errors with the default self-signed certificate. When it expires, they’ll be different certificate errors, but you’ll still be getting them. But you might run into trouble if you’re using that cert for any apps.
The “easy button” here is to sign up for TrueNAS Connect, which will give a new, trusted, and auto-renewing cert. But if you don’t want to do that, that obviously isn’t a good solution for you.
dan’s right that the browser warning just changes flavor when truenas_self expires.
if you still want a fresh self-signed without Connect or Lets Encrypt: Credentials → Certificates → Add → Create Certificate, self-signed. then System Settings → General → GUI, pick that cert, Save. UI restarts briefly. no domain needed.
only matters more if apps or a reverse proxy are pinned to the old truenas_self cert. otherwise you can ignore the alert.
Thank you for replying, @nite_route. However, @dd-b is correct. I came to make the same comment, which I think relates to the many topics which have been rendered superseded by changes in Goldeneye.
The integrated CA was removed so if I am not mistaken you cannot generate your own certs directly on TrueNAS, anymore.
Generate a CSR and sign it on an external CA. OpenSSL on the command line is enough, OPNsense provides a builtin one with a UI (which is what I use), there are various self hosted options. Or you automate all of it and use Letsencrypt.
OP here with an update. Taking a closer look yesterday I noticed I still had a certificate that I created when it was still possible to do so within Truenas. This cert expires 22 Sept. So I switched the gui to it, and logged in, no problem.
Today my truenas_self cert expired. So I tried switching back to it, but Truenas would not allow that. The result is that I still don’t know what happens when an active certificate expires! Does anyone?
Anyway, I’ll wait until the 22nd and find out. As a precaution I have disabled http → https redirect.
I generally don’t even bother with https on the GUI.
I just have my Caddy reverse proxy terminate it with an actual proper LetsEncrypt certificate that is automatically renewed without me ever doing anything and it works on all browsers without generating warnings.
Unfortunately, this does require you to be able to complete DNS-01 challenge if it’s only an internal site and that part is likely a bit complicated for most beginner home users.
Your browser will throw a tantrum but depending on how difficult it is to override the “Danger, Will Robinson” situation you will still be able to connect.
There is no technical reason why an outdated certificate would not work for encryption. It still does. It’s only that the point of the cert is besides key exchange for encryption a proof of authenticity so browsers will complain.
Adding step-ca with some Yubikey as the backend to Caddy is a very nice option (if you’re interested in having the “final authority” while remaining completely independent of the internet, i.e. domain providers and external DNS).
An interesting solution if you want to go one better than a self-signed certificate. However, self-signed is adequate for me (unless someone makes a case against), and this suggestion just creates a whole new system I have to install and maintain, when I am trying to keep things simple. Keeping it simple is the reason for this thread, as Truenas made what was simple into something hard.
You’ll embrace it as soon as you start running local microservices, apps and VMs. Of course, it isn’t worth it for a single box.
(And no, Let’s Encrypt is not an alternative for me since it is managed by a single 501(c)(3) organisation in California. So, if I had to rely on a single geographical point of failure for encryption, ‘digital sovereignty’ would be a joke. In fact, le is not ideal for a lot of people, and even less so depending on certain people’s favour.)
You can use others like ZeroSSL if you don’t like LetsEncrypt, which I believe Caddy actually defaults to now.
Maybe it’s not for you, but maintaining your own PKI kind of sucks especially for a lot of beginner homelab users, which I suspect is a big chunk of TrueNAS userbase.
Guide: Resolving Expiring Web UI Certificates on TrueNAS SCALE 25.10+ (Goldeye)
Starting with TrueNAS SCALE 25.10 (Goldeye), iXsystems completely removed the internal certificate generation engine and Certificate Authorities (CA) management interface from the Web UI. If your default self-signed truenas_gui certificate is expiring and fails to auto-renew, you must generate a compliant certificate externally and import it.
Furthermore, early sub-versions of SCALE 25.10 feature an aggressive Web UI cache/filter bug that prevents externally imported standalone certificates from showing up in the System Settings ➔ General ➔ GUI Settings dropdown list.
This guide details how to generate a fully compliant 10-year (3,650 days) certificate locally using Windows Git Bash and force-apply it directly via the TrueNAS middleware backend API.
Modern web browsers and the TrueNAS middleware strictly require certificates to include both a Subject Alternative Name (SAN) matching your exact NAS IP and a TLS Web Server Authentication extended usage flag. Additionally, TrueNAS requires the unencrypted private key to be structured in modern PKCS#8 formatting.
Open Git Bash on your computer.
Copy and paste this entire code block into the terminal, replace YOUR_NAS_IP with your actual TrueNAS IP address (e.g., 192.168.1.250), and press Enter:
# 1. Set your TrueNAS IP Address variable
NAS_IP="YOUR_NAS_IP"
# 2. Build a native configuration text file locally to handle SAN properties cleanly
echo -e "[req]\ndistinguished_name = req_distinguished_name\nx509_extensions = v3_req\nprompt = no\n[req_distinguished_name]\nCN = \$NAS_IP\n[v3_req]\nkeyUsage = critical, digitalSignature, keyEncipherment\nextendedKeyUsage = serverAuth\nsubjectAltName = IP:\$NAS_IP" > ~/Downloads/truenas.cnf && \
# 3. Compile the key and certificate using that configuration profile
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout ~/Downloads/truenas.key -out ~/Downloads/truenas.crt -config ~/Downloads/truenas.cnf -sha256 && \
# 4. Convert the private key to the precise PKCS#8 format TrueNAS demands
openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in ~/Downloads/truenas.key -out ~/Downloads/truenas_fixed.key
This command automatically exports two clean files straight into your local Windows Downloads folder:
truenas.crt (The Public Certificate)
truenas_fixed.key (The Private Key)
Step 2: Import the Certificate Files into TrueNAS SCALE
Log into your TrueNAS Web UI.
Navigate to Credentials ➔ Certificates.
Under the Certificates card, click Import (Note: the old “Add” button was replaced with “Import” in 25.10).
Set the Name field to exactly: truenas-2026
Go to your local Windows Downloads folder, right-click truenas.crt, and open it with Notepad. Copy the entire block of text and paste it cleanly into the TrueNAS Certificate field.
Right-click truenas_fixed.key in your Downloads folder and open it with Notepad. Copy the entire block of text and paste it into the TrueNAS Private Key field.
Leave the Passphrase box completely blank and click Save.
Step 3: Force-Bind the Certificate via the TrueNAS Shell API
Because of the 25.10 UI dropdown caching limitation, you must bypass the GUI menu and force-bind your new certificate database entry via the terminal.
Open your TrueNAS Web UI Shell (or SSH into the NAS).
Execute this command to query the certificate database and fetch your new asset’s internal ID layout:
Locate truenas-2026 in the printed text screen output and note the id number right next to it (e.g., 5, 7, 9).
Execute this unified command to update the system settings database directly and safely restart the web engine (replace YOUR_ID_NUMBER with your specific ID number from the step above):
Thanks for posting this. I have not had time to study your instructions, so cannot yet comment on user-friendliness and clarity to a lay home-labber like me. So I’ll get back with my thoughts. In the meantime, I hope others will chime in. Thanks everyone.
Of course, it isn’t worth it for a single box.