OpenMasjid Docs
Home
GitHub
Home
GitHub

The certificate warning, and SSH

What you need

Time: 10 minutes to read

  • You are signed in to the dashboard.

Why your browser says "Not secure"

The dashboard is served over HTTPS, which means the connection is encrypted. A certificate proves who you are connected to, and certificates are issued for public names such as example.org.

Your masjid computer has no public name. It has an address on your own network. So OpenMasjidOS makes its own certificate. That is called a self-signed certificate. Your browser cannot check who made it, so it warns you.

You click Advanced, then Proceed, once on each device.

What Settings shows you

Settings, then Security & SSL, shows which certificate is in use, when it expires, and its SHA-256 fingerprint. It gives you three things to do.

Action What it is for
Regenerate certificate Makes a new self-signed certificate. Every device shows the warning again.
Use my own certificate Install a certificate you already have, in PEM format.
The fingerprint Lets you confirm you are on the right machine, if you want to check.

Getting rid of the warning

There are two honest ways.

Accept it once per device. Most masjids do this. Two or three volunteers click through once and never think about it again.

Install a real certificate. This needs a domain name and remote access. With both, you can get a proper certificate and paste it in under Use my own certificate. The warning then stops for good.

SSH access

Settings, then SSH access, lets you add an SSH public key so you can open a terminal on the machine as root.

You need this for very little. The one command in these guides that needs it is the password reset.

  1. On your own computer, get your public key. On Windows, macOS and Linux, it is usually in .ssh/id_ed25519.pub in your home folder.
  2. Copy the whole line. It starts with ssh-ed25519.
  3. Paste it into the field in SSH access, then click Add key.
Result:

The dashboard says SSH key added. You can now sign in as root with that key.

Checkpoint

You can explain to another volunteer why the browser warning appears and why clicking through it is safe on your own network.

If something goes wrong

What you seeWhyWhat to do
The warning came back on a device that had accepted it.The certificate was regenerated, or the machine was restored from a backup.Click Advanced and Proceed once more. It is the expected result of a new certificate.
A browser gives no way past the warning.Some managed work and school devices remove the option.Use a personal device, or install a real certificate under Use my own certificate.
The certificate I pasted was refused.The certificate and the private key do not match, or the PEM text is incomplete.Paste each file whole, including its BEGIN and END lines, and check they are a matching pair.
On this page