Add SAN name to self signed TLS cert?

Hi @luckman212, thanks for your question!

I think it may be because the DNS name I'm using to access the device via Tailscale (tinypilot.ts—a manual DNS name I created in my /etc/hosts file) is not present in the CN or SAN fields of the cert.

That sounds like it could be the issue. TinyPilot's cert is valid for its hostname, the .local variant, the .localdomain variant, and its static IP address (if applicable). So if you access TinyPilot's web interface with https://tinypilot.ts, the certificate won't be valid and your browser may flag that.

You can add .ts as an additional Subject Alt Name by editing TinyPilot's cycle-nginx-tls-keys script, cycling your keys, and re-installing the cert on your client machine.

To edit the script, SSH into your TinyPilot and run the following command to add .ts to the SAN in the script:

sudo sed --in-place \
  's/^SUBJECT_ALT_NAME=.*/SUBJECT_ALT_NAME="DNS:${HOSTNAME}, DNS:${HOSTNAME}.local, DNS:${HOSTNAME}.localdomain, DNS:${HOSTNAME}.ts"/' \
  /opt/tinypilot-privileged/scripts/cycle-nginx-tls-keys

Then run the script with the following command to regenerate your keys:

sudo /opt/tinypilot-privileged/scripts/cycle-nginx-keys

Once the script completes, re-install the cert on your client machine.

If you update your TinyPilot's software, it will overwrite your changes to the script, so you may have to run through those changes again in the future.

I hope that helps! Please let me know if that works and whether you have any questions.

@david Awesome! Thanks for the help. This worked perfectly! I would only suggest that in a future release, a field for custom SAN name(s) would be safer than hand-editing the scripts.