HTTPS/SSL setup

Setting up HTTPS and SSL is optional, especially if you’re running Pi-Hole on your home network. However, if you are using Pi-Hole on a public network (such as at a business), it’s advisable to enable HTTPS and SSL for added security.

Follow these instructions to set it up:

First we're going to install the required packages. We're going to do that by using apt. We're going to install a package that allows a web server to serve HTTPS requests and to handle SSL certificates.

# 1. Install required packages
sudo apt update
sudo apt install lighttpd-mod-openssl

Once we've installed the packages, we need to then go and generate some SSL certificates. We'll start off by making a directory to store our certificates and then change into that directory.

# 2. Generate SSL certificate
# Create directory for certificates
sudo mkdir -p /etc/lighttpd/ssl/
cd /etc/lighttpd/ssl/

Okay, now we're inside the directory, we're going to go and generate a self-signed certificate.

# Generate self-signed certificate (or use your own certificate)
sudo openssl req -new -x509 -keyout pihole.pem -out pihole.pem -days 365 -nodes

Once the certificate has been generated, we need to give it the proper file permissions, and we do that with chmod.

# Set proper permissions
sudo chmod 744 pihole.pem

• 7 (Owner): Read (4), Write (2), Execute (1) → Total: 7 (rwx)
• 4 (Group): Read (4), No Write (0), No Execute (0) → Total: 4 (r–)
• 4 (Others): Read (4), No Write (0), No Execute (0) → Total: 4 (r–)

The permissions we gave the file were 744. That means that the owner can read, write and execute the file, but everybody can only read the file.

We need to configure the web server for SSL. Before proceeding, we’ll back up the web service configuration to ensure safety.

# 3. Configure lighttpd for SSL
# Backup original config
sudo cp /etc/lighttpd/external.conf /etc/lighttpd/external.conf.backup

Now I'm going to go in and edit our config file. We'll do that with the text editor on the command line called nano, but you can use Vi or Emacs if you're more familiar with those.

# Create/edit external.conf
sudo nano /etc/lighttpd/external.conf

We're now going to add the following configuration to the file and this is going to tell the web server where to find our SSL certificates.

# Add the following configuration:
$SERVER["socket"] == ":443" {
    ssl.engine = "enable"
    ssl.pemfile = "/etc/lighttpd/ssl/pihole.pem"
    ssl.ca-file = "/etc/lighttpd/ssl/pihole.pem"
    ssl.honor-cipher-order = "enable"
    ssl.cipher-list = "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"
    ssl.use-compression = "disable"
    ssl.use-sslv2 = "disable"
    ssl.use-sslv3 = "disable"
}

Once we've done that, we're going to enable the required modules.

# 4. Enable required modules
sudo lighttpd-enable-mod ssl
sudo lighttpd-enable-mod openssl

OK, once those modules are enabled, we can then test our configuration to make sure everything's working.

# 5. Test configuration
sudo lighttpd -t -f /etc/lighttpd/lighttpd.conf

If the web server doesn't complain, we can now go and restart with the new configuration.

# 6. Restart lighttpd
sudo systemctl restart lighttpd

Remember to adjust your firewall settings if you’ve configured one, such as the Universal Firewall on your Raspberry Pi. Ensure port 443 is open, as HTTPS uses this port instead of port 80.

# 7. Configure firewall (if enabled)
sudo ufw allow 443/tcp