Joplin-Server SSL configuration

[RRohi]

Hello

Can somebody help me configure SSL in my Joplin LXC instance?

I was looking for guides online and found only many copies of the same guide based on Nginx and Certbot pulling certs from Let's Encrypt.

I can't find Nginx in the Joplin community installation, and I'm going to use internal ADCS certs, not Let's Encrypt.

I can manage installing the root CA in the system store, but where would I add the host certs?

[MohammadThabetHassan]

Joplin Server itself doesn't do TLS, which is why there is no nginx to find. In this install it runs as a plain HTTP app on port 22300 (the server just calls app.listen(config().port) in packages/server/src/app.ts), so the host cert goes into a small reverse proxy in the same LXC that forwards to 22300. Caddy is the least work on Debian 13:

apt install -y caddy

ADCS usually gives you a .pfx, so split it into PEM files first and append the issuing CA after the host cert, so clients get the full chain:

openssl pkcs12 -in joplin.pfx -clcerts -nokeys -out /etc/caddy/joplin.crt
openssl pkcs12 -in joplin.pfx -nocerts -nodes -out /etc/caddy/joplin.key
cat issuing-ca.crt >> /etc/caddy/joplin.crt
chown root:caddy /etc/caddy/joplin.key && chmod 640 /etc/caddy/joplin.key

If openssl says the PFX uses an unsupported algorithm (older ADCS templates use RC2/3DES, which OpenSSL 3 disables), add -legacy to both commands.

/etc/caddy/Caddyfile:

joplin.corp.example {
    tls /etc/caddy/joplin.crt /etc/caddy/joplin.key
    reverse_proxy 127.0.0.1:22300
}

With an explicit cert and key Caddy doesn't try Let's Encrypt at all. Then set APP_BASE_URL=https://joplin.corp.example (no port) in /opt/joplin-server/.env and run systemctl restart joplin-server caddy. That variable matters: the server builds its links and login redirects from it, so leaving it at http://IP:22300 sends you back to plain HTTP. The script's update function backs up and restores that .env, so the change survives updates.

A few things to check afterwards: the hostname in the Caddyfile has to match a SAN in the cert, every Joplin client (desktop and mobile) needs your root CA trusted on that device, not only inside the LXC, and Joplin still listens on 22300 on all interfaces, so block that port from outside the container if you want HTTPS only.

[RRohi]

Thanks for the answer/solution.