← All posts

Node Setup Umbrel 2.0 November 3, 2026

How to Install and Trust the Root CA Certificate on Umbrel 2.0: Complete HTTPS Setup Guide

If you run a home server or Bitcoin node on Umbrel, you are likely accustomed to accessing your dashboard via http://umbrel.local. For years, running self-hosted apps over unencrypted HTTP or self-signed setups meant dealing with persistent browser security warnings, broken mobile sync capabilities, and stubborn compatibility errors.

With the release of Umbrel 2.0, the Umbrel team has added native support for an internal trusted Certificate Authority (Root CA). By exporting and trusting this Root CA on your client devices, you unlock full green-lock HTTPS access across your entire local network without jumping through third-party DNS or reverse proxy hoops.

In this guide, we walk through why a Root CA matters for self-hosting, how it resolves compatibility hurdles in apps like Nextcloud, Vaultwarden, and Immich, and the step-by-step walkthrough to download and trust the certificate on Windows.

Watch Forrest HODL demonstrate how to export and trust the Root CA certificate on Umbrel 2.0 in Windows.

1. Why Umbrel 2.0's Root CA Is a Massive Upgrade

A Root Certificate Authority (Root CA) is the foundational cryptographic anchor used to establish trust between your operating system, web browsers, and server applications. When your browser connects to a web service, it checks whether the SSL/TLS certificate was signed by a recognized Certificate Authority in your device's trusted root store.

Previously on older Umbrel versions, accessing your local server meant connecting over plain HTTP:

  • Browser warnings: Modern web browsers (Chrome, Brave, Firefox, Safari) throw aggressive red warning screens ("Your connection is not private") whenever you connect to a server that lacks a trusted certificate.
  • Application restrictions: Critical self-hosted utilities require secure contexts (https://). For instance, Vaultwarden (the self-hosted Bitwarden password manager) disables clipboard auto-fill and mobile extensions over plain HTTP due to browser web crypto API requirements.
  • Nextcloud & mobile syncing issues: Desktop synchronization clients and mobile operating systems (iOS and macOS especially) often reject unencrypted sync endpoints for calendar, contact, and file syncing.
  • Local network routing quirks: Without HTTPS, managing sensitive Bitcoin node data, Lightning channels, and password databases exposes local traffic to eavesdropping across compromised local Wi-Fi networks.

Pre-Requisite: This feature is built exclusively into the new Umbrel 2.0 operating system. If you are still running an older 0.5.x or 1.x version, backup your node channels and files before executing your OS upgrade.

2. Comparing Umbrel 2.0 to Start9 Server

In a previous comparison between the Start9 Embassy / ServerOS and Umbrel for running dedicated Bitcoin nodes and self-hosted apps, root CA management was a decisive differentiator.

On Start9's platform, setting up and trusting the Root CA is practically a required first step during initial onboarding. Because Start9 enforces HTTPS across all local .local and Tor addresses, users are guided immediately to trust the certificate, ensuring error-free operation right from the start.

Umbrel 2.0 closing this gap is a significant improvement for the ecosystem. While Umbrel has tucked the certificate settings a bit deep into the settings menu, once configured, it brings Umbrel up to parity with the security standard self-hosters expect.

3. Step-by-Step Guide: Install & Trust Umbrel Root CA on Windows

While Umbrel provides certificate profiles for Windows, macOS, iOS, and Android, the tutorial below covers the complete installation flow for Windows 10 and Windows 11.

Step 1: Navigate to Network Certificate Settings

Log into your Umbrel dashboard. In the bottom navigation bar or sidebar:

  1. Click Settings at the bottom of the interface.
  2. Open Advanced Settings.
  3. Select Network.
  4. Look for the section labeled How to use HTTPS or click the dropdown arrow next to the certificate settings.
  5. Click into Advanced Certificate Settings.

Step 2: Download the Windows Certificate File

From the platform selection tabs (Mac, Windows, iOS, Android):

  1. Click the Windows tab.
  2. Click Download Certificate and save the file to your Downloads folder.
  3. Note: Because the download initiates from your unencrypted http://umbrel.local session, modern browsers like Brave or Chrome may flag the download as untrusted. Click the download prompt and choose Keep or Keep Anyway.

Step 3: Launch the Windows Certificate Import Wizard

Open your Windows File Explorer and locate the downloaded certificate:

  1. Double-click the downloaded certificate file and select Open (using Crypto Shell Extensions if prompted).
  2. In the Certificate dialog box, click Install Certificate... at the bottom.
  3. On the Store Location prompt, select Local Machine (requires administrator access) and click Next.
  4. When the Windows User Account Control (UAC) prompt appears, click Yes.

Step 4: Select the Trusted Root Certification Authorities Store

Crucial step: Do not leave the certificate store on automatic. You must explicitly target the trusted root directory:

  1. Select Place all certificates in the following store.
  2. Click Browse...
  3. Select the folder named Trusted Root Certification Authorities and click OK.
  4. Click Next, then click Finish.
  5. You will see a dialog stating "The import was successful." Click OK and close any open certificate property windows.

Step 5: Verify HTTPS Access

Open a fresh browser tab (or restart your browser session to reload the certificate authority cache):

  1. Type https://umbrel.local in the address bar.
  2. The persistent "Not Secure" warning will disappear and be replaced by a secure connection padlock.
  3. Log into your Umbrel dashboard over an authenticated, encrypted local session.

4. App Compatibility: Immich, Nextcloud, and Password Managers

Once your root certificate is trusted across your machines and devices, app compatibility improves dramatically:

  • Immich Photo Backups: If you use Immich on Umbrel to automatically backup photos from your mobile phone, you can configure your server endpoint with either HTTP or HTTPS. However, having native HTTPS eliminates background sync dropouts and certificate verification rejections on iOS.
  • Vaultwarden: Modern browser security architecture blocks password autofill APIs on non-secure origins. Once HTTPS is live, browser extensions on Firefox, Chrome, and Brave function without workarounds.
  • Nextcloud: Nextcloud's WebDAV syncing engines on macOS and Windows require secure channels to prevent credential interception across local subnets.

Summary Checklist

Setting Legacy Umbrel Umbrel 2.0 with Root CA
Protocol HTTP (Unencrypted local) HTTPS (Encrypted local)
Browser Warnings Frequent "Not Secure" warnings Clean lock, trusted status
Vaultwarden Auto-fill Blocked / degraded Fully operational
Certificate Store Target N/A Trusted Root Certification Authorities

Need Help Setting Up Your Bitcoin Node & Home Server?

Whether you are choosing between Umbrel and Start9, syncing a full Bitcoin core node, setting up Electrum Server, or configuring private cloud backups, book a 1-on-1 private coaching session to get direct personalized guidance.

Book a 1:1 Coaching Session

Watch the Video Walkthrough

Watch Forrest HODL guide you through the Umbrel 2.0 interface and demonstrate the Windows certificate import process step by step.

Watch on YouTube Visit pathtobitcoin.xyz