Webauthn registration issue | Tailscale Community | Page 1

tired dune Feb 16, 2026, 5:01 PM

#

I am having an issue trying to add a yubikey passkey to my vaultwarden instance that is on my tailnet. There are no error on the back-end.
Im getting the same issue on both chrome and firefox:

**The relying party ID is not a registrable domain suffix of, nor equal to the current domain. Subsequently, an attempt to fetch the .well-known/webauthn resource of the claimed RP ID failed.
**

The DOMAIN(a vaultwarden setup) is set properly, and the vault is funneled, so the IP is public. Since the error is only showing up on the browser, I wanted to check here if it's a known limitation of using webauthn with TS.

Thanks!

versed osprey Feb 16, 2026, 5:03 PM

#

It sounds like your vaultwarden instance is configured with a primary domain that doesnt match the .ts.net one youre accessing it from

#

webauthn/passkeys are very strictly tied to domains so you need to set them up with the domain that is configured as the primary and then never change this domain (or if you do change it, the passkeys will break)

#

its an intentional part of their phishing protection

tired dune Feb 16, 2026, 5:04 PM

#

But it is the same domain, exactly :S

versed osprey Feb 16, 2026, 5:04 PM

#

what domain is vaultwarden configured to use as its primary?

tired dune Feb 16, 2026, 5:05 PM

#

what do you mean specifically by its primary?

#

just to give you a better overview, vaultwarden is running in docker, connected to my TS using tsbridge. Normal operations (web or browser plugins) work flawlessly

versed osprey Feb 16, 2026, 5:06 PM

#

the DOMAIN env variable apparently

#

https://github.com/dani-garcia/vaultwarden?tab=readme-ov-file#docker-compose

tired dune Feb 16, 2026, 5:07 PM

#

yup, it's set to the https:// for my vault's TS name

#

https://vault."my ts".ts.net

#

never mind the stupid quoting but it matches what I use to connect to it.

versed osprey Feb 16, 2026, 5:08 PM

#

interesting, that error suggests theres a mismatch somewhere but ive not used vaultwarden enough to understand where

#

i saw https://github.com/dani-garcia/vaultwarden/discussions/6567 but dont really understand it

GitHub

DOMAIN and rp_id should detach in webuthn context · dani-garcia va...

Given configuration values "domain"(config) and "domain_origin"(config). Domain(config) defines the full URL to access the vaultwarden application. Domain_origin(config) defines...

tired dune Feb 16, 2026, 5:10 PM

#

well well well!

#

given the could work/works now table, it's their fault!

#

@versed osprey
Thanks for helping me confirm that it's not related to TS!

versed osprey Feb 16, 2026, 5:14 PM

#

yeah i think in this scenario we're a domain (well, subdomain) like any other and its up to this software how it wants to handle that

#

they have their own community on matrix/discourse as well as gh discussions, may be worth asking in one of those

#

unless someone knows more and can share here!

tired dune Feb 16, 2026, 5:17 PM

#

based on that GH discussion, they are working on it. I will wait for them to be ready!

#

one question, if you will allow it. There are not pure browser solution to connect to a tailnet right ? I'd like to connect a windows machine to a tailnet but I cannot install tailscale (no admin privileges)

versed osprey Feb 16, 2026, 5:20 PM

#

you can run the client in userspace mode without admin perms but its much more complicated to setup

#

theres https://github.com/tailscale/ts-browser-ext/ which aims to automate that but its highly experimental and doesnt yet work on windows

#

besides that, tailscale ssh does work in browser from the admin panel though

tired dune Feb 16, 2026, 5:23 PM

#

versed osprey you can run the client in userspace mode without admin perms but its much more c...

I will investigate, see if it's even allowed. Thanks again, appreciate your support!

versed osprey Feb 16, 2026, 5:27 PM

#

heres the doc if you want to attempt it https://tailscale.com/docs/concepts/userspace-networking

Tailscale

Userspace networking mode (for containers) · Tailscale Docs

Find out about userspace networking mode and when it is useful.

#

it says for containers but well... it also works on other platforms

#

i'd create a new help thread if you want help with that because its a whole different rabbit hole

tired dune Feb 16, 2026, 5:32 PM

#

I mean I have done it with a simple ssh -D in wsl. that works too.
I will read the doc though.
again. thank you so much!

versed osprey Feb 16, 2026, 5:37 PM

#

ah yes, you can install it in wsl too!

#Webauthn registration issue