Hacker News Reader

> The two issues I had over the years was: My SSL cert expiring (not really a Jellyfin issue).

If your SSL cert is from Let’s Encrypt, certbot will auto-renew it for you

Thanks, I did use Let's Encrypt and had certbot setup but didn't realise the renew process required port 80 open (I had blocked it on my firewall).

You don’t need port 80 open, you can do DNS based challenge.

1) Transfer your domain to someone who provides a DNS API like DigitalOcean or Cloudflare

2) download the appropriate plugin for certbot (certbot-dns-digitalocean, certbot-dns-cloudflare)

3) get an API token and config the plugin with it

4) set up a post-renew-hook to do a `service nginx reload` to reload the new cert

Thanks for your reply, this was really helpful I will give it a shot.

How does this work on a LAN or other private network? Can it?

You can do DNS based challenges without exposing your network itself if you have a real domain name.