How to set up HTTPS on Jellyfin and have it renew automatically?

This short post covers setting up HTTPS on Jellyfin.

Prerequisites that are assumed to be met:

• you already have a certificate created and signed prior to this;
• reverse-proxy (like nginx) is set up and working.

Idea

Creating a certificate is rather simple, be it Let’s Encrypt or a self-signed one, or something from a provider like Cloudflare. However, the pain arises when you want to have this certificate supplied to Jellyfin without having to worry about it expiring. Sure, it’s not a very tedious task to renew it once in a while yourself, but Jellyfin only takes PKCS#12 certificates, so before you are able to feed it yours, you have to create a PKCS#12 certificate from your crt.pem and key.pem files.

Creating the script

If your server already is set up to renew your certificates, this should be pretty easy. You can use nano to create a script, for example:

nano /var/lib/jellyfin/update_jellyfin_certs.sh

This is a very simple and working script that can be used to create a PKCS#12 certificate file:

#!/bin/bash

CERT_DIR="/path/to/yours/certs"
OUTPUT_PFX="/var/lib/jellyfin/jellyfin.pfx"
PFX_PASSWORD="YourPasswordHere"

# Convert the certificate and key to PKCS#12 format
openssl pkcs12 -export \
    -inkey "$CERT_DIR/key.pem" \
    -in "$CERT_DIR/crt.pem" \
    -certfile "$CERT_DIR/crt.pem" \
    -out "$OUTPUT_PFX" \
    -passout pass:$PFX_PASSWORD

# Set the correct permissions
chown jellyfin:jellyfin "$OUTPUT_PFX"
chmod 600 "$OUTPUT_PFX"

echo "Jellyfin PKCS#12 certificate updated successfully!"

Very simple. You may change the OUTPUT_PFX directory to whatever you wish. I believe having it together with its files makes it more tidy, is all.

Setting up CRON job

I believe using a cronjob to trigger the script is the easiest way to have this working. You can set the frequency of the job to whatever you deem right. I decided that I would like it to be executed every day, so this example will cover the cron job being executed at 3 AM daily as an example.

We use crontab -e to add the following line at the end:

0 3 * * * /var/lib/jellyfin/update_jellyfin_cert.sh >> /var/log/jellyfin/jellyfin_cert_update.log 2>&1

As you may notice, I also set it to write a log to the location where Jellyfin logs ought to be, but you can also change that if you prefer / use a different location.

That is IT! You have working HTTPS.