How to Auto-Renew Tailscale HTTPS Certificates on PiKVM Using systemd
PiKVM users running Tailscale for remote access must manually handle HTTPS certificate renewals, as certificates obtained via 'tailscale cert' are not automatically renewed. A community-developed solution uses a systemd timer that runs daily to check whether the current certificate matches the device's Tailscale FQDN and has at least 30 days of validity remaining. If renewal is needed, the script temporarily switches PiKVM's read-only filesystem to read-write, fetches a fresh certificate using the '--min-validity=720h' flag, and replaces the nginx SSL files before restoring the filesystem to read-only. The approach aligns with official PiKVM documentation, which recommends placing Tailscale certificates in '/etc/kvmd/nginx/ssl/' and restarting the kvmd-nginx service after updates. Since Let's Encrypt certificates are valid for 90 days, triggering renewal at the 30-day mark provides a comfortable buffer against expiration.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)
Log in to join the discussion and vote.
Log in