Your Address and HTTPS

When you opt into web serving, the server gets a hostname of its own under nas2.dk and a real, browser-trusted certificate. No self-signed warnings, no certificate to install on the devices that connect.

Only when you ask

The network drive needs none of this: it works on names local to your network, and a drive-only server never contacts my backend at all. The hostname and certificate are provisioned the first time you turn on web serving on the Serve tab, or from Settings → Website. Provisioning takes about two minutes, most of it deliberately waiting for DNS, and the app shows its progress.

The hostname

The server registers and is assigned a hostname like x7k2q9.nas2.dk. That name follows the server wherever it goes: NAS Reborn keeps the DNS records pointed at the device's current address, on your home network and, when reachable, on the wider internet. Share links use this hostname, so they keep working when your connection changes.

The certificate

The certificate is a genuine Let's Encrypt certificate, and the device itself does the work: it proves control of its hostname through a DNS challenge, orders the certificate, and installs it. The private key is generated on the device and never leaves it, and renewal happens automatically well before expiry.

The app shows the certificate lifecycle plainly: validating through Let's Encrypt, active with its expiry date, or a legible error when something is wrong (DNS trouble, rate limits, no network).

Over that connection the server speaks HTTP/2 to any browser that asks for it, so a page's images, stylesheets and scripts all travel down one connection instead of queueing. It is also what makes low-latency camera feeds play at their full speed, since Apple's video player only accepts them over HTTPS.

Why the hostname is used even at home

Certificates cannot be issued for .local names or bare IP addresses, so those would always produce browser warnings. The nas2.dk hostname works both ways: on your own network it resolves to the device's local address, and from outside to your public one. Same URL, valid HTTPS everywhere.

Router blocking the name at home? Some routers ship with "[DNS rebind protection](https://en.wikipedia.org/wiki/DNS_rebinding)", which refuses public hostnames that resolve to private addresses, exactly what a LAN-mode server hostname does. NAS Reborn detects this, names the router doing it, and leaves the blocked hostname out of the addresses it offers. The fix is a router setting: allowlist nas2.dk in the rebind-protection exceptions, or switch the network's DNS server.

Your own domain

With the Pro unlock the server can also answer on a name under your own domain, like files.yourdomain.com, with a valid certificate of its own. In Settings → Website choose Add custom domain… and create the two records it shows you at your DNS provider:

files.yourdomain.com as a CNAME to your nas2.dk hostname, which keeps the domain pointed at the device;
_acme-challenge.files.yourdomain.com as a CNAME to the matching challenge name under nas2.dk, which lets the device answer certificate challenges for your domain without any access to your DNS account.

The device then extends its certificate to cover the domain and keeps it renewed like its own. Each custom domain can pick which folder it serves as its home page, so blog.yourdomain.com can be the blog folder directly. One caveat: a CNAME cannot sit on a bare domain apex, so use a subdomain such as files. or www., or a DNS provider with ALIAS-type records.