some file

Certificate issues

Updated

TLS and certificate problems on a self-hosted deployment. For other areas, start from Troubleshooting.

Let's Encrypt certificate not renewing

Symptom: The TLS certificate expires and does not auto-renew, so clients and browsers report an expired or invalid certificate.

Likely causes and fixes (most common first):

  1. Port 443 is not reachable from the internet. The bundled Traefik proxy validates with the TLS-ALPN-01 challenge, which runs over inbound TCP/443. Confirm your firewall and cloud security groups allow it. Port 80 only serves the HTTP→HTTPS redirect and is not used for validation, so opening it does not fix issuance.
  2. The domain no longer points at this host. Verify the A/AAAA record resolves to the server's public IP.
  3. A renewal error in the proxy. Check the proxy's logs: docker compose logs traefik. Traefik reloads its configuration on its own, so there is no reload command; if you need to force a retry, restart the container with docker compose restart traefik.

Deployments created before NetBird switched to Traefik may still run Caddy, which can also use the HTTP-01 challenge on port 80. On those, keep inbound TCP/80 open and check docker compose logs caddy instead.

Confirm: curl -vI https://YOUR_DOMAIN 2>&1 | grep -E "issuer|expire" shows a current Let's Encrypt certificate.

Certificate errors with custom reverse proxy

Symptom: TLS errors when terminating TLS on your own reverse proxy instead of the bundled one.

Likely causes and fixes (most common first):

  1. Let's Encrypt is still enabled, so two components fight over TLS. Set NETBIRD_DISABLE_LETSENCRYPT=true so NetBird stops managing certificates and leaves termination to your proxy.
  2. Forwarded headers are missing. Set X-Forwarded-For and X-Forwarded-Proto on the proxy so NetBird sees the original scheme and client.
  3. gRPC fails without HTTP/2. The Management gRPC endpoints need HTTP/2; enable it on the proxy.

Confirm: The dashboard loads over your proxy without TLS warnings, and netbird status from a client shows Management: Connected.