# How to use self-signed certificates with openvidu-local-deployment in offline environment?

**URL:** <https://openvidu.discourse.group/t/how-to-use-self-signed-certificates-with-openvidu-local-deployment-in-offline-environment/5289>\
**Category:** Issues with deployments\
**Created:** [February 6, 2025, 7:22am UTC](https://openvidu.discourse.group/t/how-to-use-self-signed-certificates-with-openvidu-local-deployment-in-offline-environment/5289 "2025-02-06T07:22:40Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![AoEiuV020](https://yyz2.discourse-cdn.com/free1/user_avatar/openvidu.discourse.group/aoeiuv020/32/2408_2.png) [@AoEiuV020](https://openvidu.discourse.group/u/AoEiuV020)\
**Post date:** [February 6, 2025, 7:22am UTC](https://openvidu.discourse.group/t/how-to-use-self-signed-certificates-with-openvidu-local-deployment-in-offline-environment/5289/1 "2025-02-06T07:22:40Z")

</div>

Hi,

I’m trying to deploy openvidu-local-deployment in an air-gapped environment (no internet access). Currently facing an issue where Caddy fails to obtain certificates for HTTPS since it cannot connect to the internet.

I noticed the Caddy configuration is generated by a program called “local-caddy-generate”.

Questions:

1. Is the source code for “local-caddy-generate” available?

2. Is it possible to configure it to use self-signed certificates instead of obtaining them from the internet?

3. Are there any alternative solutions for using openvidu-local-deployment with self-signed certificates in an offline environment?

4. Or are there any better deployment solutions specifically designed for air-gapped environments?

Environment:

- Using openvidu-local-deployment 3.0.0

- Air-gapped network environment (no internet access)

Thank you for your help!

---

<div class="post-metadata">

**Author:** ![cruizba](https://yyz2.discourse-cdn.com/free1/user_avatar/openvidu.discourse.group/cruizba/32/18_2.png) [@cruizba](https://openvidu.discourse.group/u/cruizba)\
**Post date:** [February 6, 2025, 9:42pm UTC](https://openvidu.discourse.group/t/how-to-use-self-signed-certificates-with-openvidu-local-deployment-in-offline-environment/5289/2 "2025-02-06T21:42:29Z")

</div>

Right now it is not possible to use `openvidu-local-deployment` with self signed certs, and the source code is not available.

But you can deploy OpenVIdu Single Node which is virtually the same, but focused for production: [OpenVidu Single Node installation on-premises - openVidu](https://openvidu.io/latest/docs/self-hosting/single-node/on-premises/install/)

You need 2 things:

1. Configure a Domain name in your LAN which points to the private IP of the host where you want to install OpenVidu
2. Install OpenVidu following the documentation instructions (Select `owncert` as certificate type and paste there your certificates).
3. After install it configure at `/opt/openvidu/config/livekit.yaml` your private IP:

```auto
rtc:
    use_external_ip: false
    node_ip: <your_private_ip>

```

Note that openvidu-local-deployment **is intended to make development easier** , but it is not intended for production use cases because the certificates are publicly known.

---

<div class="post-metadata">

**Author:** ![cruizba](https://yyz2.discourse-cdn.com/free1/user_avatar/openvidu.discourse.group/cruizba/32/18_2.png) [@cruizba](https://openvidu.discourse.group/u/cruizba)\
**Post date:** [February 6, 2025, 9:58pm UTC](https://openvidu.discourse.group/t/how-to-use-self-signed-certificates-with-openvidu-local-deployment-in-offline-environment/5289/3 "2025-02-06T21:58:23Z")

</div>

Mmm I am thinking that maybe adding a `--lan-network-mode` to the OpenVidu installer is maybe a good idea for users which wants to deploy OpenVidu in LAN networks 🤔

---

<div class="post-metadata">

**Author:** ![AoEiuV020](https://yyz2.discourse-cdn.com/free1/user_avatar/openvidu.discourse.group/aoeiuv020/32/2408_2.png) [@AoEiuV020](https://openvidu.discourse.group/u/AoEiuV020)\
**Post date:** [February 7, 2025, 9:38am UTC](https://openvidu.discourse.group/t/how-to-use-self-signed-certificates-with-openvidu-local-deployment-in-offline-environment/5289/4 "2025-02-07T09:38:45Z")

</div>

The OpenVidu Single Node version doesn’t seem to support offline deployment. There are many network-related dependencies, and even after addressing them one by one, it still fails to connect upon startup. The logs are quite extensive, and it’s difficult to identify the specific issues from them.

**Issues I addressed:**

1. Prepared the necessary scripts and Docker images in advance to avoid dependencies on the network during installation.
2. Preloaded `grafana_data/data/plugins` to prevent downloads after startup.
3. Disabled IPv6; otherwise, MongoDB would fail to connect.

After these adjustments, the system seems to start successfully, but nothing can be connected. Accessing `http` returns a 308 status code, and accessing `https` results in an error.

```auto
# curl -vkL localhost
* About to connect() to localhost port 80 (#0)
* Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 80 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: localhost
> Accept: */*
> 
< HTTP/1.1 308 Permanent Redirect
< Connection: close
< Location: https://localhost/
< Server: Caddy
< Date: Fri, 07 Feb 2025 09:36:07 GMT
< Content-Length: 0
< 
* Closing connection 0
* Issue another request to this URL: 'https://localhost/'
* About to connect() to localhost port 443 (#1)
* Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 443 (#1)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* NSS error -5938 (PR_END_OF_FILE_ERROR)
* Encountered end of file
* Closing connection 1
curl: (35) Encountered end of file

```

---

<div class="post-metadata">

**Author:** ![AoEiuV020](https://yyz2.discourse-cdn.com/free1/user_avatar/openvidu.discourse.group/aoeiuv020/32/2408_2.png) [@AoEiuV020](https://openvidu.discourse.group/u/AoEiuV020)\
**Post date:** [February 7, 2025, 9:41am UTC](https://openvidu.discourse.group/t/how-to-use-self-signed-certificates-with-openvidu-local-deployment-in-offline-environment/5289/5 "2025-02-07T09:41:14Z")

</div>

By the way, I’m using the self-signed mode. This mode should be able to generate certificates in an offline environment, right?

---

<div class="post-metadata">

**Author:** ![cruizba](https://yyz2.discourse-cdn.com/free1/user_avatar/openvidu.discourse.group/cruizba/32/18_2.png) [@cruizba](https://openvidu.discourse.group/u/cruizba)\
**Post date:** [February 10, 2025, 11:31am UTC](https://openvidu.discourse.group/t/how-to-use-self-signed-certificates-with-openvidu-local-deployment-in-offline-environment/5289/6 "2025-02-10T11:31:53Z")

</div>

Yes, selfsigned does not require internet connection.

Can you show me your caddy logs? Did you tried to use `curl` against the domain name of your machine?

> 1. Disabled IPv6; otherwise, MongoDB would fail to connect.

This will be fixed for cleans installations at 3.1.0. Local connections to MongoDB will be through 127.0.0.1, not localhost.

---

<div class="post-metadata">

**Author:** ![AoEiuV020](https://yyz2.discourse-cdn.com/free1/user_avatar/openvidu.discourse.group/aoeiuv020/32/2408_2.png) [@AoEiuV020](https://openvidu.discourse.group/u/AoEiuV020)\
**Post date:** [February 13, 2025, 10:15am UTC](https://openvidu.discourse.group/t/how-to-use-self-signed-certificates-with-openvidu-local-deployment-in-offline-environment/5289/7 "2025-02-13T10:15:58Z")

</div>

Previously, I made a mistake:

1. Using the domain name works fine for access.
2. I am using a public domain name like `192-168-0-153.nip.io`.
3. However, I hope to access the service directly using an IP address or allow any domain name to work. This is because I want to support environments without DNS or network connectivity.

Should I modify the `/opt/openvidu/config/caddy.yaml` file to achieve this? Is there a simpler method to implement this?

---

<div class="post-metadata">

**Author:** ![cruizba](https://yyz2.discourse-cdn.com/free1/user_avatar/openvidu.discourse.group/cruizba/32/18_2.png) [@cruizba](https://openvidu.discourse.group/u/cruizba)\
**Post date:** [February 15, 2025, 11:18pm UTC](https://openvidu.discourse.group/t/how-to-use-self-signed-certificates-with-openvidu-local-deployment-in-offline-environment/5289/8 "2025-02-15T23:18:02Z")

</div>

Yes, you should probably modify `/opt/openvidu/config/caddy.yaml`. I think its possible, but we did not test accessing the infrastructure using a single IP.

What you did with `nip.io` is exactly the best way to use it in a LAN environment.