How to Set Up Trusted HTTPS for Local Homelab Domains (Coolify + Traefik)

If you’re running self-hosted services in your homelab — Nextcloud, Gitea, Vaultwarden, or anything else — you’ve probably run into the dreaded “Your connection is not private” warning, or worse, apps that flat-out refuse to connect over HTTPS.

In this guide I’ll show you exactly how to set up a proper trusted TLS certificate for your local domains (like *.home.l) using OpenSSL, and configure it to work with Coolify’s Traefik proxy — so browsers, the Nextcloud desktop client, and mobile apps all trust it without warnings.

Why Your Existing Self-Signed Cert Probably Doesn’t Work

Most people generate a quick self-signed cert like this:

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes

This creates a cert where the Issuer = Subject (self-signed), and only sets a CN (Common Name) field. The problem? Modern browsers and apps have required Subject Alternative Names (SAN) since 2017. A CN-only cert will be rejected by:

• Chrome / Chromium
• Firefox (in strict mode)
• Nextcloud desktop client
• Android apps

You’ll get errors like NET::ERR_CERT_AUTHORITY_INVALID Or the Nextcloud client will show “Failed to connect to the secure server address.”

You can verify if your cert has SAN with:

openssl x509 -in your.cert -text -noout | grep -A5 "Subject Alternative"

If you see nothing — that’s your problem.

The Right Approach: A Two-Layer Setup

The correct solution is a two-layer PKI:

homelab-ca.crt   ← Your local Certificate Authority (import this into browsers/OS)
     └── signs
         home.l.cert  ← Wildcard cert used by Traefik (has proper SAN)

You import the CA once into each device/browser, and it automatically trusts every cert signed by it — including all your *.home.l subdomains.

Prerequisites

• A Linux server (Proxmox, Ubuntu, Debian — anything with OpenSSL)
• Coolify installed with Traefik as the proxy
• Your local domain resolving via DNS (Pi-hole, dnsmasq, /etc/hosts, or a router)

Step 1 — Generate the Certificate Authority (CA)

SSH into your server and navigate to Coolify’s cert directory:

cd /data/coolify/proxy/certs

Generate the CA private key and self-signed CA certificate:

openssl genrsa -out homelab-ca.key 4096

openssl req -x509 -new -nodes -key homelab-ca.key -sha256 -days 3650 \
  -out homelab-ca.crt \
  -subj "/CN=Homelab CA"

This creates a CA valid for 10 years. Keep homelab-ca.key safe — anyone with this file can sign certificates trusted by your devices.

Step 2 — Generate the Wildcard Certificate with SAN

Generate the server private key and a Certificate Signing Request (CSR):

openssl genrsa -out home.l.key 2048

openssl req -new -key home.l.key \
  -out home.l.csr \
  -subj "/CN=*.home.l"

Create a SAN extension file:

cat > home.l.ext << EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage=digitalSignature, keyEncipherment
extendedKeyUsage=serverAuth
subjectAltName=@alt_names

[alt_names]
DNS.1=*.home.l
DNS.2=home.l
EOF

Sign the cert with your CA:

openssl x509 -req -in home.l.csr -CA homelab-ca.crt -CAkey homelab-ca.key \
  -CAcreateserial -out home.l.cert -days 3650 -sha256 -extfile home.l.ext

Verify the SAN is present:

openssl x509 -in home.l.cert -text -noout | grep -A3 "Subject Alternative"

You should see:

X509v3 Subject Alternative Name:
    DNS:*.home.l, DNS:home.l

Step 3 — Restart Traefik

Coolify uses a Docker container called coolify-proxy for Traefik. Restart it to pick up the new cert:

docker restart coolify-proxy # it maybe with different name, use `docker ps` to verify

Verify it’s serving the new cert:

openssl s_client -connect nextcloud.home.l:443 -servername nextcloud.home.l 2>/dev/null \
  | openssl x509 -noout -subject -issuer

You should now see the issuer as CN=Homelab CA instead of CN=*.home.l.

Step 4 — Import the CA into Your Devices

This is the key step. You only need to do this once per device/browser.

Firefox

1. Go to Settings → Privacy & Security → View Certificates → Authorities
2. Click Import and select homelab-ca.crt
3. Check “Trust this CA to identify websites”
4. Click OK

Chrome / Chromium

1. Go to Settings → Privacy & Security → Security → Manage certificates
2. Go to the Authorities tab
3. Click Import, select homelab-ca.crt
4. Check “Trust this certificate for identifying websites”

Linux System (for desktop apps like Nextcloud client)

sudo cp homelab-ca.crt /usr/local/share/ca-certificates/homelab-ca.crt
sudo update-ca-certificates

Then restart the Nextcloud desktop client.

Windows

Double-click homelab-ca.crt → Install Certificate → Local Machine → Place in “Trusted Root Certification Authorities”

Troubleshooting

Summary

With this setup, any subdomain of home.l (like nextcloud.home.l, git.home.l, vault.home.l) will be trusted automatically across all your devices once you’ve imported the CA — no more browser warnings, and desktop/mobile apps will connect cleanly over HTTPS.

Running a homelab with Proxmox and Coolify? I write about self-hosting, Linux, and DevOps at techlino.net.

Please leave this field empty

Oh hi there 👋
It’s nice to meet you.

Sign up to receive awesome content in your inbox, every month.

We don’t spam! Read our privacy policy for more info.

Check your inbox or spam folder to confirm your subscription.

Mohammad Dahamshi

I’m a software engineer with roots in embedded systems and a growing focus on DevOps and self-hosted infrastructure. CKA certified, CCNA background, and a homelab that never sleeps — running Proxmox, Kubernetes, Docker, Coolify, and more. On techlino.net I share practical guides on Linux, virtualization, and infrastructure built from real experience.