Trust The Vaulthalla CA
Install the name-constrained Vaulthalla CA on Macs, iPhones and iPads, Linux, Windows, Android and Firefox, verify it, and remove it.
Trust The Vaulthalla CA
An internal hostname such as vault.home.arpa gets its certificate from the CA that vh setup caddy creates. Each device that opens Vaulthalla has to trust that CA once. Until it does, browsers show a certificate warning: do not click through it, because the warning is the only thing telling you that you reached your own server.
Why It Is Safe To Trust
The Vaulthalla CA's certificate carries critical X.509 name constraints listing only your Vaulthalla hostnames (or the --ca-scope domain). Current operating systems and browsers refuse any certificate it signs for another name. Trusting it lets it vouch for vault.home.arpa, not for your bank.
Check what a CA covers before you install it:
1openssl x509 -in vaulthalla-local-ca.crt -noout -subject -fingerprint -sha2562openssl x509 -in vaulthalla-local-ca.crt -noout -text | grep -A3 'Name Constraints'Compare the SHA-256 fingerprint with the one vh setup caddy printed on the Mac. Install a certificate only if they match.
Get The Certificate
On the Mac that runs Vaulthalla, the certificate is at:
1/Library/Application Support/Vaulthalla/vaulthalla-local-ca.crtIt is a public certificate (no private key), readable by everyone. Copy it to the device by AirDrop, mail, a USB stick or scp.
Install It
On the Mac running Vaulthalla:
1sudo vh setup caddy --trustOn any other Mac:
1sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain vaulthalla-local-ca.crtmacOS asks for confirmation. Safari, Chrome and most apps use the System keychain.
- Send the
.crtto the device (AirDrop or Mail) and open it. iOS says a profile was downloaded. - Open Settings → General → VPN & Device Management, select the profile and choose Install.
- Open Settings → General → About → Certificate Trust Settings and turn on full trust for the Vaulthalla CA.
Step 3 is easy to miss: without it, the certificate is installed but not trusted.
Debian, Ubuntu and derivatives:
1sudo cp vaulthalla-local-ca.crt /usr/local/share/ca-certificates/2sudo update-ca-certificatesBrowsers that keep their own certificate store (Firefox, Chromium snaps) may need the certificate imported there as well.
In an Administrator command prompt:
1certutil -addstore -f Root vaulthalla-local-ca.crtEdge and Chrome use the Windows store.
Settings → Security → More security settings → Encryption & credentials → Install a certificate → CA certificate, then pick the file. The menu names vary by vendor.
Android trusts user-installed CAs in Chrome, but many apps ignore them by design.
Firefox on macOS and Windows trusts certificates from the system store when security.enterprise_roots.enabled is on (the default there). Otherwise import it: Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import, and tick "Trust this CA to identify websites".
Name Resolution
Trust is only half of it: the device must also resolve vault.home.arpa to the Mac. Add a DNS record (A or AAAA) for it on your router or local DNS server. On the Mac itself, sudo vh setup caddy --hosts-entry adds a marked /etc/hosts line for testing.
When The CA Changes
vh setup caddy creates a new CA when you configure a hostname outside the current one's constraints, and vh teardown caddy --purge deletes it. Devices then need the new certificate. Plan names up front with --ca-scope (for example --ca-scope home.arpa) to avoid this.
Remove Trust
Remove the CA from devices when you retire the Mac or purge Caddy:
1# macOS (or Keychain Access → System → Certificates): find its SHA-1 hash, then delete by hash2security find-certificate -a -Z -c "Vaulthalla Local CA" /Library/Keychains/System.keychain | grep -E 'SHA-1|"alis"'3sudo security delete-certificate -Z <SHA-1 hash> /Library/Keychains/System.keychain4 5# Debian/Ubuntu6sudo rm /usr/local/share/ca-certificates/vaulthalla-local-ca.crt7sudo update-ca-certificates --freshOn iPhone and iPad, remove the profile in Settings → General → VPN & Device Management. On Windows, use certmgr.msc → Trusted Root Certification Authorities. The certificate's common name starts with Vaulthalla Local CA, followed by the hostname and the date it was created.