Skip to content

Config: Default to a self-signed HTTPS/TLS certificate if no other certificate is available #3509

Description

@lastzero

If I specify https:// as the protocol in the site URL config option and don't have a valid certificate installed, I expect a default certificate to be available so that HTTPS can always be enabled.

In order for this to work and not to break existing installations that use an external HTTPS reverse proxy, the environment variable PHOTOPRISM_DEFAULT_TLS needs to be set to true. PhotoPrism will then default to a self-signed certificate if the site URL starts with https:// and no other certificate is available.

The default certificate has the filename /etc/ssl/certs/photoprism.cert and the corresponding private key is /etc/ssl/private/photoprism.key. These files are automatically created when the Docker container starts for the first time and PHOTOPRISM_INIT includes "https" or the PHOTOPRISM_DEFAULT_TLS variable is set to "true".

Note that these default filenames cannot be configured at the moment. However, you can specify custom filenames with PHOTOPRISM_TLS_CERT and PHOTOPRISM_TLS_KEY. Since PHOTOPRISM_DEFAULT_TLS defaults to "false", I currently don't see a need to let users configure the default filenames as well.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

releasedAvailable in a stable releasesecurityImpact on server or browser security

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions