Tailscale HTTPS Certificates

~12 min · tailscale, https, tls, lets-encrypt

Level 0Pinger

0 XP0/101 lessons0/12 achievements

0/150 XP to next level150 XP to go0% complete

Real TLS for your machines

Tailscale can provision real, publicly-trusted TLS certificates for your machine names via Let's Encrypt with DNS-01 challenges. This means you can run HTTPS services on your machines with valid certificates — no self-signed warnings, no manual cert management.

How to use the certs

tailscale cert writes a .crt and .key for the device's MagicDNS FQDN. Hand them to nginx, Caddy, your Python app, anything that wants TLS. Cert lifetime is 90 days (Let's Encrypt standard); Tailscale auto-renews via the same command on a schedule.

Code

Issue and use a cert·bash

# Issue a cert for this device (run as the user that needs the files)
tailscale cert office.tail-net.ts.net

# Output:
#   wrote office.tail-net.ts.net.crt
#   wrote office.tail-net.ts.net.key

# Use with Python's stdlib server
python -m http.server 4443 \
    --bind 0.0.0.0 \
    --certfile office.tail-net.ts.net.crt \
    --keyfile office.tail-net.ts.net.key

# Or with caddy
# caddy reverse-proxy --from https://office.tail-net.ts.net --to localhost:8000

External links

Tailscale: HTTPS certificates

Exercise

On one Tailscale device, enable HTTPS in the admin console (Settings → Feature Previews). Then run tailscale cert <fqdn>. Start a Python server with the cert+key on port 4443 and visit https://<fqdn>:4443 from another tailnet device — green padlock, no warnings.