How do I add self-signed cert for https connection?

[scotrod]

Hey!

First of all - it's an awesome app. I just want to ask how I can add self-signed cert, so I can access my local instance via HTTPS instead of HTTP only? I did not find anything in the documentation.

Thanks!

[code-asher]

You can make code-server use a self-signed certificate directly with --cert and --cert-key and you can generate a certificate with a tool like mkcert.

https://github.com/coder/code-server/blob/main/docs/guide.md#using-a-self-signed-certificate

But if you can it would be better to stand up a reverse proxy like Caddy or NGINX and use your self-signed certificates there. You can also use them to automatically redirect http to https.

Or better yet if you can get a domain you can automate real certificates from Let's Encrypt: https://github.com/coder/code-server/blob/main/docs/guide.md#using-lets-encrypt-with-caddy

[scotrod]

You can make code-server use a self-signed certificate directly with --cert and --cert-key and you can generate a certificate with a tool like mkcert.

https://github.com/coder/code-server/blob/main/docs/guide.md#using-a-self-signed-certificate

But if you can it would be better to stand up a reverse proxy like Caddy or NGINX and use your self-signed certificates there. You can also use them to automatically redirect http to https.

Or better yet if you can get a domain you can automate real certificates from Let's Encrypt: https://github.com/coder/code-server/blob/main/docs/guide.md#using-lets-encrypt-with-caddy

Thanks for the reply!

As far as I know (please correct me if I'm wrong) Let's Encrypt requires public facing service in order to serve the certificate? I do not wish to expose anything from my private network to the Internet.

Regarding the reverse proxy... May I ask you for some additional info/guide, why would this be the better opportunity in my case? I am trying to set up and secure this service the best and most secure way.

[code-asher]

Let's Encrypt requires public facing service in order to serve the certificate?

Yup that is right.

I do not wish to expose anything from my private network to the Internet.

Makes sense!

why would this be the better opportunity?

There are no security reasons to use a reverse proxy over code-server directly (that I know of) so if running code-server alone works for you then go for it! I recommend a reverse proxy mostly because code-server's handling of TLS and automatic https redirects are broken in some very specific cases (probably not any that you will run into) and because if you ever need to do anything slightly more complex then you will need a reverse proxy anyway.

[scotrod]

Thanks! I usually go with the less complex and more secure way (if possible) way of dealing with anything when it comes to home-labbin. For my purposes, using https for vscode server will be overkill anyway, but since I'm eager to learn more, I treat my home network as a hostile one. Will try to implement a self-hosted SSL cert in VS Code directly.

Thanks again!