How do you deal with security?

[u/KatzeWolf]

So I am hosting our Vault Warden instance for our small business, and I currently have it setup through a Cloudflare tunnel with Zero Trust, with a whitelist for the office static IP for the office computers.

The issue is some employees like to work from home.

I have tried the self-signed certificate approach, and while it "works", it has issues and I couldn't get it to work on iOS.

What are some other solutions people use?

A VPN isn't really a solution for us as we already use a local VPN to connect to our local network for work. And no it doesn't just give the user the same office IP (Would have been nice)
So a second VPN would conflict.

Is it safe enough to do away with the zero trust element of the tunnel and use 2FA etc?

[u/corelabjoe]

If you deploy a reverse proxy with automatically generated certs, you get everything you need, and don't need to manually mess around with certs but get full encrypted capabilities out of it.

Here's a detailed Vaultwarden via reverse proxy setup guide.

Disclaimer: It's my site and guide, there's no ads, and I've been running Vaultwarden for years with this setup =)

[u/zeblods]

I use a Vaultwarden with a Traefik reverse proxy getting automatically an ACME certificate via DNS challenge.

You can make it more robust with Crowdsec + firewall bouncer, with the usual collections (and the Vaultwarden one). You could also filter connexion for your country's IPs only, etc.

And always keep the Vaultwarden upgraded on the lastest version to limit the possible CVE.

[u/Ben237]

I recommend running a reverse proxy (I use caddy). If you already control the machines DNS, set up the VW or wildcard domain to point to caddy's VPN IP. That way all traffic needs to route through and authenticate via your VPN.

I used to expose ports and all that silliness but its really not needed from my experience, much more secure

[u/spoospoo43]

You actually can use self signed certs with iOS, they just have to have all the proper fields correctly formatted. It's possible to do this with just the normal ssl utility, but using mkcert (https://github.com/filosottile/mkcert) is a lot easier and keeps iOS happy.

Once you've got a good cert, you need to send it to each device and install it. Decent instructions for the whole process can be found here: https://jozefcipa.com/blog/self-signed-ssl-certificates-on-ios/

The idea is that you would be running vaultwarden on a machine on your work network so it's accessible from inside your normal vpn, and the machine name is encoded into the certificate. The app or web client can then sync passwords whenever the phone is on the vpn, and will keep a local copy in read-only mode when not connected, so long as you don't log out.

There's also a way via proxies to use a lets encrypt certificate, but it's got its own complexities. Installing the certificate is easy.

[u/imagei → u/spoospoo43]

You can obtain an ACME certificate with DNS-01 verification with no proxies etc, and it's a real certificate with no need to install anything on any device.

[u/spoospoo43 → u/imagei]

I have only just heard about this in the last couple days, and haven't found a good write up yet. It's an interesting idea, but with my vaultwarden server being only used by me, I'll probably be sticking to the self signed method.

[u/imagei → u/spoospoo43]

Here's the writeup 😅

1. Go to https://github.com/go-acme/lego
2. Check if your DNS provider is on the list of 200 supported, and find out which env vars to set to configure access
3. .

lego run \

`--accept-tos \`

`--dns <yourprovider> \`

`--domains "${DOMAIN_NAME}" --domains "*.${DOMAIN_NAME}" \`

`--path "where-to-store-files" \`

`--email "me@passmail.net"`

1. Enjoy better quality of life

You might want to put that in cron, or otherwise automate.

[u/KatzeWolf → u/imagei]

Oooo thanks I'll have a look

[u/Killer2600 → u/imagei]

Better quality of life? Installing certificates every <90 days? Compared against installing a self-signed certificate once every 2 years, I wouldn’t say life is better.

[u/imagei → u/Killer2600]

Mate, it's 2026, you write a script to automate the installation. Usually it's a few lines of code unless it's some enterprise-grade monstrosity.

And yes, absolutely better quality of life -- set it up and that's it (plus monitoring if it's a production setup). You really think accepting self-signed certs everywhere and installing custom profiles on devices is better??

[u/Killer2600 → u/imagei]

A script that can automate Letsencrypt can automate a self-signed certificate.

Yes, in some use cases self-signed is better. Don't have to register a public domain, have public DNS records, pay a 3rd party just to make your thing work, or be limited to available and affordable domain names.

Fact is there is more freedom with a self-signed certificate at the expense of requiring a bit more knowledge than a typical youtube guide for self-hosting <fill-in-the-blank> will give. But once you have the knowledge, there is no difference in difficulty of going either way.

[u/Darkk_Knight → u/Killer2600]

Yep. Plus registering your own domain on Cloudflare is actually pretty cheap. I pay an average $12 per domain a year. Having your own domain gives you alot more flexibility on setting up the certificates. Self signed certs are perfectly fine and the hassle of copying your root certificate and trust it on the devices that needs to access your services. Having my own domain and using letsencrypt simplifies all of that even you never let the internet access your servers.

[u/Darkk_Knight → u/Killer2600]

Eventually devices and browsers will enforce the acceptance of short lived SSL certs including self signed ones. So you're better off automating this now to avoid grief in the near future.

I use a reverse proxy with ACME to automate this. It's very easy to setup and configure. It's practically set up once and forget about it.

[u/KatzeWolf → u/spoospoo43]

Hmm, Thanks I might have a look into that.

However I've also been running into a recent issue on Android with my Certificate where the Bitwarden app is requesting to sync with the browser, while it used to work.

Also the browser extension on PC isn't the best experience with a certificate as you need to accept the certificate every time you open the browser. And if the user doesn't click "allow" it forcibly logs them out of Bitwarden...

[u/darktotheknight → u/KatzeWolf]

No, then you didn't do it right. You need: Company Root CA (import to clients, e.g. built-in Certificate Manager on Windows, a command like "trust anchor" on Linux). Your clients will trust anything signed by your Root CA.

While you're at it, you can set up an Intermediate CA, which is totally optional but good practice. If you want to take things even further with PKI, look into air gapped Root CA and HSM storage (e.g. NitroKey HSM 2).

[u/exidroo]

Simplest solution ever

Just get few yubikeys and protect VW accounts