I run privatly 3x TrueNAS NAS and just installed 25.10 to one of them and wanted to c+p my default config to it. I had to find out (in comparision to 25.04), that SMART check and local CA were removed .
Since the default certificate lasts 1 year, in the past I always created a local ca and created new certificates that last 5 years. Now I can not do this anymore. I checked the wiki and found this:
Iâm sure the official answer is, âpay for a TrueNAS Connect subscription,â which (among other things) will get you a certificate for something like 192-168-1-176.cr49fa5fij885c9jhncnkquoin20d23t52an3ug.l226e8evc5ldjcspgcppqt378sj9n4btef62ojo.truenas.direct and keep it up-to-date.
If you do own a domain, move its DNS to Cloudflare for free, and use that get trusted certs that renew automatically.
Otherwise, you donât care about certificate errors in your browser anyway, so just continue to use the default cert after it expires.
Yes. The built-in ACME cert generation in TrueNAS uses DNS validation (which is why the DNS host matters), and therefore doesnât depend on having a public IP address or public access to your TrueNAS server (which you should never have).
Another possibility is to use a different ACME client (like, e.g., acme.sh or lego) to get your cert using DNS validation with your current DNS host, and then use an automated tool to deploy it to your NAS when it renews. See:
I have a tool that you can use to import a certificate to your TrueNAS 25.10 server. See, tnas-certdeploy. Itâs written in Go but I have made available pre-compiled binaries in the latest release, tnas-certdeploy 1.3.
I use the tool to import my wildcard lets encrypt certificate to my two TrueNAS-SCALE instances. I have a VM that runs the acme scripts to keep my certs updated and I use this tool, tnas-certdeploy in an acme post install script to update my NAS machines. My domain is registered with cloudflare and I use a split horizon DNS. My public A records are with cloud flare and my private A records are under congrol of the unbound DNS server on my OpenSense router.
Yep, thats what i did because for some reason strato still has no dns api, that would allow you to auto request lets encrypt wildcard certificates. Now my pfsense can use acme to update the wildcard if needed and provide it to the reverse proxy. Works like a charm without any manual intervention
I donât know what you mean by âfantasyâ here, but youâd create local DNS records pointing to your NAS. So if you own example.com, youâd go to whatever device is providing DNS for your LAN (your router, a Pi-Hole/AdGuard Home installation, your own instance of BIND, whatever) and create a DNS record for truenas.lan.example.com pointing to your NAS.
Youâd then create a cert for truenas.lan.example.com, or maybe *.lan.example.com if youâre planning on using that cert for other apps as well.
Indeed they do; you canât get a public cert for private identifiers.
You donât; you access it via FQDN. Because yes, accessing via the IP will give you cert errors.
.