This section helps you choose a secure way to access an i-net CoWork server when the server is located in a private network or when only selected services should be publicly available. It covers publicly trusted certificates, private access, DNS validation and tunnel services.

The suitable method depends on whether users can install a client, whether the server has a public address and whether the DNS provider offers an API. The Web Server configuration describes the HTTPS connection, certificate sources and the external visible URL.

The following options are available:

• Private HTTPS - Use a registered domain with split DNS when the server is reachable only inside the private network.
• DNS-01 - Obtain a publicly trusted certificate by proving control of a DNS name, without exposing the server to the Internet.
• DNS-PERSIST-01 beta - Test persistent DNS authorization with a staging CA when the DNS provider has no usable API.
• External ACME clients - Use tools such as acme.sh or Certbot to automate certificate issuance and install the files used by the server.
• Tailscale - Connect known devices to a private network and publish the local web service to that network.
• Public services - Compare direct publication, reverse proxies and managed tunnel services.
• Troubleshooting - Resolve common DNS, certificate, proxy and renewal problems.

Use split DNS with automated DNS-01 when the server remains private, users access a normal domain name and your DNS provider offers an API. The public DNS zone is used only for certificate validation, while internal DNS resolves the service name to a private address.

Use Tailscale Serve when access is limited to known devices and installing a client on those devices is acceptable. Use a protected public tunnel when users need browser access without a VPN client.

Use DNS-PERSIST-01 only as an experimental staging option. It is not a replacement for a production DNS-01 workflow until a certificate authority and the selected ACME client provide stable production support.

The Let's Encrypt Certificate page describes the integrated certificate request for servers that can be validated through the Internet. For custom certificates, the Automatic update of custom SSL Certificates page explains how changed certificate files can be loaded without interrupting the server.

• Private HTTPS
• DNS-01
• DNS-PERSIST-01 Beta
• External ACME Clients
• Tailscale
• Public and Partially Public Services
• Secure Access Troubleshooting