The Network section under Settings is where you set the address people reach your Burrow at and the HTTPS certificate it serves. A Burrow runs its own HTTPS out of the box with a self-signed certificate. From here you can give it your own domain and swap that certificate for a browser-trusted one. Changing anything here needs permission for the Burrow's network settings.
Address and HTTPS#
Two lines at the top show where things stand. HTTPS says how connections are secured: on with a self-signed certificate, on with your own certificate, or terminated upstream when something in front of the Burrow handles HTTPS. Address is the URL to reach the Burrow at, built from its domain, or its local network address, and its port.
Custom domain#
Enter the domain you want to reach the Burrow at, such as vault.example.com, and select Save. Point that domain's DNS at the Burrow yourself. A browser trusts the domain only once the Burrow serves a certificate that matches it, which is what the certificate options below are for.
While the Burrow is on its self-signed certificate, saving a domain folds that domain into the certificate so the address lines up, and it takes effect on the next restart. With your own certificate in place, the domain is simply recorded for the address shown, since an uploaded certificate carries its own names.
The certificate#
A Burrow that serves its own HTTPS gives you three ways to handle the certificate. Certificate changes are staged and take effect when the Burrow restarts, and the page shows a banner with Restart now when one is waiting. If the Burrow cannot restart itself, stop and start it where it is hosted.
Self-signed, the default#
Every Burrow starts with a self-signed certificate, generated and stored for you. Browsers show a warning for it, because no public authority vouches for it. The certificate fingerprint shown here is the Burrow's identity: check it the first time you connect, and match it against what the CLI or a machine reports. It stays the same across domain changes and renewals, so it is a stable value to confirm once. Copy it with the button beside it.
Automatic certificate, Let's Encrypt#
For a browser-trusted certificate at no cost, enter a contact email and select Enable. Two things have to be in place first: a custom domain set above, and port 80 reachable to the Burrow so Let's Encrypt can verify the domain (see Remote access for forwarding a port). The contact email is where Let's Encrypt sends expiry notices.
Issuance runs in the background, and the status here moves from Requesting a certificate to Certificate issued with its expiry date. It renews on its own before expiry, and Renew now forces it early. Restart the Burrow once a new certificate has been issued to start serving it.
Your own certificate#
To use a certificate from your own authority, choose a PKCS12 bundle (.p12 or .pfx) holding your domain's certificate and private key, enter its password if it has one, and select Upload. Revert to a self-signed certificate returns to the built-in one at any time.
When HTTPS is terminated upstream#
If you run the Burrow behind your own reverse proxy and it handles HTTPS, the HTTPS line reads Terminated upstream and there is no certificate to manage here. The certificate options appear only when the Burrow serves HTTPS itself.
Through the RatelKey relay#
When your Burrow is reached through the RatelKey relay, it serves HTTPS for its relay address itself, with a browser-trusted certificate it renews on its own. The certificate's private key is made on your Burrow and never leaves it, and the relay passes your traffic through without being able to read it.
That certificate is separate from the one on this page, which keeps serving connections that reach the Burrow directly. Turn the relay on or off under Remote access.