Where to place proxy.crt and proxy.key, rmfakecloud manual device setup | reMarkable | Page 1

idle island Dec 12, 2025, 8:59 PM

#

I've been trying to set up rmfakecloud manually without a proxy, but I don't know where I should place proxy.crt and proxy.key. It only explains what directory to place ca.crt in.
https://ddvk.github.io/rmfakecloud/remarkable/setup/#modify-device-etchosts

Device - rmfakecloud

Self hosted reMarkable sync cloud

ancient scroll Dec 12, 2025, 9:01 PM

#

What are you using for a proxy? You shouldn’t need any of the actual end certs or keys on device, just the ca cert.

idle island Dec 12, 2025, 9:11 PM

#

ancient scroll What are you using for a proxy? You shouldn’t need any of the actual end certs o...

I thought I could skip a proxy and just edit the /etc/hosts file

ancient scroll Dec 12, 2025, 9:11 PM

#

You need a proxy somewhere

#

Doesn’t have to be on-device, but it has to be somewhere

#

At least.. I think you do

wintry sparrow Dec 12, 2025, 9:12 PM

#

ancient scroll You need a proxy somewhere

If you setup the device to trust the cert you don't need the proxy

ancient scroll Dec 12, 2025, 9:13 PM

#

Will rmfakecloud just respond to all the traffic that gets sent its way?

#

You’ll at least need rmfakecloud listening on 443 directly

wintry sparrow Dec 12, 2025, 9:13 PM

#

Yes

#

exactly

wintry sparrow Dec 12, 2025, 9:14 PM

#

idle island I've been trying to set up rmfakecloud manually without a proxy, but I don't kno...

This is a linux device, you'll need to just place it in the standard location for ca-trust

#

adn then call update-ca-trust extract I believe

idle island Dec 12, 2025, 9:15 PM

#

so proxy.crt and proxy.key are just steps to get ca.crt and are therefore not needed?

wintry sparrow Dec 12, 2025, 9:15 PM

#

a ca certificate is used to generate the actual certificate used by the server

#

So it's the opposite, you need the ca.crt to generate proxy.crt and proxy.key

ancient scroll Dec 12, 2025, 9:16 PM

#

And then those two go on rmfakecloud

idle island Dec 12, 2025, 9:18 PM

#

ancient scroll And then those two go on rmfakecloud

In which dir should I place them?

wintry sparrow Dec 12, 2025, 9:19 PM

#

idle island In which dir should I place them?

What steps are you following to setup rmfakecloud's server?

idle island Dec 12, 2025, 9:20 PM

#

wintry sparrow What steps are you following to setup rmfakecloud's server?

These https://ddvk.github.io/rmfakecloud/remarkable/setup/#modify-device-etchosts

Device - rmfakecloud

Self hosted reMarkable sync cloud

wintry sparrow Dec 12, 2025, 9:20 PM

#

That's not the server

#

That's the device

#

Have you setup the rmfakecloud server anywhere yet?

idle island Dec 12, 2025, 9:20 PM

#

docker

#

well, in my case podman using the docker image

#

localhost:3000

wintry sparrow Dec 12, 2025, 9:21 PM

#

Set the TLS_CERT and TLS_KEY environment variables to point to where you bind mount the files

#

And localhost will not work from your rM, you'll have to provide the ip address it can reach your machine at

#

and port 3000 will also not work

#

it'll need to be port 443

#

Unless you put a proxy in front of it, in which case, ignore the TLS_CERT and TLS_KEY environment variables and setup the proxy's certificate

idle island Dec 12, 2025, 9:23 PM

#

Can't I specify the port in the /etc/hosts file on the rm?

wintry sparrow Dec 12, 2025, 9:23 PM

#

No

ancient scroll Dec 12, 2025, 9:23 PM

#

Hosts is just DNS

wintry sparrow Dec 12, 2025, 9:24 PM

#

The hosts file format is <ip> <hostname> [<hostname>...]

idle island Dec 12, 2025, 9:24 PM

#

so my rmfakecloud container should have a different ip if I didn't want to have it using my computer's 443 port

ancient scroll Dec 12, 2025, 9:26 PM

#

Another reason proxies are nice. They let you overload ip addressss cause they look at the host headers

idle island Dec 12, 2025, 9:31 PM

#

Do you generate the key and certs on the host or on the device?

ancient scroll Dec 12, 2025, 9:31 PM

#

Wherever you’ve got OpenSSL

#

The place you generate them doesn’t matter

#

The rM never needs to know about the end cert/key

idle island Dec 12, 2025, 9:34 PM

#

The ca.crt is only needed for the client apps and the device if I'm correct

ancient scroll Dec 12, 2025, 9:36 PM

#

Yep, cause it’ll say “I made rmfakecloud’s cert and you trust me”

#

Well more accurately, rmfakecloud’s cert is will say “I was made by ca.crt” and your device trusts the ca.crt

idle island Dec 12, 2025, 10:15 PM

#

Is this all right?

root@reMarkable:~# update-ca-certificates
Updating certificates in /etc/ssl/certs...
rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

#

I got a warning about skipping

ancient scroll Dec 12, 2025, 10:16 PM

#

Looks good to me

idle island Dec 12, 2025, 10:19 PM

#

I got worried about the skipping part. Also, according to the documentation I have now to add the env variable STORAGE_URL=https://local.appspot.com to the server. Does the URL need to point to something specific or do I just add it as is? I changed the TLS_CERT and TLS_KEY environment variables to point to my respective files

ancient scroll Dec 12, 2025, 10:27 PM

#

I believe it defaults to that

idle island Dec 12, 2025, 10:27 PM

#

It seems that I did not the set the variables right. I can't run the server with

TLS_KEY=/path-to-file/proxy.key
TLS_CERT=/path-to-file/proxy.crt
STORAGE_URL=https://local.appspot.com

as my env variables

ancient scroll Dec 12, 2025, 10:39 PM

#

What error do you get?

idle island Dec 12, 2025, 10:44 PM

#

📎 message.txt

#

it happens whenever I add the env variables

#

but these logs aren't descriptive. I get the container removed right after it is stopped, so I can't check podman logs rmfakecloud

idle island Dec 12, 2025, 10:56 PM

#

wintry sparrow Set the TLS_CERT and TLS_KEY environment variables to point to where you bind mo...

if I mount my fails at /something/data, do I have to use the variables as

TLS_CERT=/something/data/proxy.cert
TLS_KEY=/something/data/proxy.key

?

wintry sparrow Dec 12, 2025, 10:56 PM

#

Yes

#

It's the path inside the container

idle island Dec 12, 2025, 10:57 PM

#

wintry sparrow It's the path inside the container

inside the container?
Like /something/data:/data
the one on the right?

wintry sparrow Dec 12, 2025, 10:58 PM

#

The one on the right

#

the container cannot access the host system, so where it is on the host system is not the value to use in the env variable

#

you need the path that the container can access

idle island Dec 12, 2025, 11:01 PM

#

Now it works. But just with http, I thought this setup guaranteed https

wintry sparrow Dec 12, 2025, 11:07 PM

#

I'm not sure I understand, xochitl will use https to connect

#

Have you exposed the 8883 port

#

I guess that's the MQTT port, not https

ancient scroll Dec 12, 2025, 11:09 PM

#

Yeah that’s mqtt for screenshare

wintry sparrow Dec 12, 2025, 11:10 PM

#

As this setup isn't one that's actually documented, I'm taking a look at the source to see if it's actually going to server https

ancient scroll Dec 12, 2025, 11:13 PM

#

I had to swap my ingress backend protocol to https when I setup mqtt since mqtt/https use the same cert

wintry sparrow Dec 12, 2025, 11:13 PM

#

That's what I thought

#

I do see tls configuration being setup for the certificate

#

and it would then start a https server instead of a http server

#

@idle island What does the rmfakecloud logs say when it is starting up?

#

I'm not seeing the startup logs here, just randomly in the middle

#

Oh wait, I misread

#

Yeah it also leaked some things you don't want to leak

#

It's not loading the certificate though

idle island Dec 12, 2025, 11:17 PM

#

I restarted everything

podman logs rmfakecloud
time="2025-12-12T23:17:04Z" level=warning msg="The authentication will fail the next time you start the server!"
time="2025-12-12T23:17:04Z" level=warning msg="JWT_SECRET_KEY was not set! The following was autogenerated"
time="2025-12-12T23:17:04Z" level=warning msg="JWT_SECRET_KEY=nothing"
time="2025-12-12T23:17:04Z" level=warning msg="RM_HTTPS_COOKIE is not set, use only when not using https!"
time="2025-12-12T23:17:04Z" level=warning msg="smtp not configured, no emails will be sent"
time="2025-12-12T23:17:04Z" level=info msg="if you want HWR, provide the myScript applicationKey in: RMAPI_HWR_APPLICATIONKEY"
time="2025-12-12T23:17:04Z" level=info msg="provide the myScript hmac in: RMAPI_HWR_HMAC"
time="2025-12-12T23:17:04Z" level=info msg="Version: v0.0.26"
time="2025-12-12T23:17:04Z" level=info msg="Data: /data"
time="2025-12-12T23:17:04Z" level=info msg="Listening on port: 3000"
time="2025-12-12T23:17:04Z" level=info msg="Using plain HTTP"

wintry sparrow Dec 12, 2025, 11:17 PM

#

So it's using plain HTTP instead of HTTPS

#

You'll want to remove the secrets from that log

idle island Dec 12, 2025, 11:18 PM

#

maybe because I didn't change the port yet?

wintry sparrow Dec 12, 2025, 11:18 PM

#

There is no TLS certificates configured line

#

Port wouldn't matter here

#

it's not loading the TLS certificate

#

Go check to make sure that you can find and read the files inside the containers at the paths you specified

ancient scroll Dec 12, 2025, 11:23 PM

#

Kinda tough with this container cause it’s from scratch

idle island Dec 12, 2025, 11:23 PM

#

so I think it is because I forgot to add the STORAGE_URL variable, now it works

#

firefox doesn't trust this much though

ancient scroll Dec 12, 2025, 11:24 PM

#

Firefox may not use the system cert store, I can’t remember

idle island Dec 12, 2025, 11:25 PM

#

ancient scroll Dec 12, 2025, 11:27 PM

#

You need to add the ca cert to Firefox’s trusted root cert store

idle island Dec 12, 2025, 11:35 PM

#

root@reMarkable:~# mkdir -p /usr/local/share/ca-certificates
root@reMarkable:~# update-ca-certificates
Updating certificates in /etc/ssl/certs...
rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
root@reMarkable:~# cat /etc/hosts
127.0.0.1    localhost

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
127.0.1.1 reMarkable

# rmfakecloud
192.168.1.135 hwr-production-dot-remarkable-production.appspot.com
192.168.1.135 service-manager-production-dot-remarkable-production.appspot.com
192.168.1.135 local.appspot.com
192.168.1.135 my.remarkable.com
192.168.1.135 ping.remarkable.com
192.168.1.135 internal.cloud.remarkable.com
192.168.1.135 eu.tectonic.remarkable.com
192.168.1.135 backtrace-proxy.cloud.remarkable.engineering
192.168.1.135 dev.ping.remarkable.com
192.168.1.135 dev.tectonic.remarkable.com
192.168.1.135 dev.internal.cloud.remarkable.com
192.168.1.135 eu.internal.tctn.cloud.remarkable.com


root@reMarkable:~# ping  my.remarkable.com
PING my.remarkable.com (192.168.1.135): 56 data bytes
64 bytes from 192.168.1.135: seq=0 ttl=64 time=3.643 ms
64 bytes from 192.168.1.135: seq=1 ttl=64 time=6.884 ms
64 bytes from 192.168.1.135: seq=2 ttl=64 time=6.868 ms
64 bytes from 192.168.1.135: seq=3 ttl=64 time=6.539 ms
64 bytes from 192.168.1.135: seq=4 ttl=64 time=6.658 ms
64 bytes from 192.168.1.135: seq=5 ttl=64 time=6.885 ms
64 bytes from 192.168.1.135: seq=6 ttl=64 time=6.710 ms
^C
--- my.remarkable.com ping statistics ---
7 packets transmitted, 7 packets received, 0% packet loss
round-trip min/avg/max = 3.643/6.312/6.885 ms
root@reMarkable:~# ls /usr/local/share/ca-certificates
ca.crt

#

I tried syncing, but it didn't work. I added the ca.crt file via sftp in case you wonder why it doesn't seem like I have placed it.

ancient scroll Dec 12, 2025, 11:36 PM

#

And your container is reachable on 443 now?

idle island Dec 12, 2025, 11:36 PM

#

oh, my bad

#

when I change the host port to 443, like 443:3000, it fails. I saw in the documentation that there was an env variable to change the port, I don't know if that might have to do

wintry sparrow Dec 12, 2025, 11:41 PM

#

idle island when I change the host port to 443, like 443:3000, it fails. I saw in the docume...

Changing the port bound on the host is enough

#

if you change the port that it hosts on internally, you have to change which port you bind on

#

What is the failure you encounter when you rebound the port? Was it failing to start the container, or was it just still failing to connect the device to rmfakecloud

idle island Dec 12, 2025, 11:43 PM

#

wintry sparrow What is the failure you encounter when you rebound the port? Was it failing to s...

to start the container

ancient scroll Dec 12, 2025, 11:43 PM

#

Depending on your OS, you might have to fiddle with stuff to bind to privileged ports (under 1024)

idle island Dec 12, 2025, 11:44 PM

#

I'm on Fedora Workstation 43

wintry sparrow Dec 12, 2025, 11:44 PM

#

rootful podman?

idle island Dec 12, 2025, 11:45 PM

#

Failed to bind port 443 (Permission denied) for option '-t 443-443:3000-3000'

#

I found that line

idle island Dec 12, 2025, 11:45 PM

#

wintry sparrow rootful podman?

rootless

wintry sparrow Dec 12, 2025, 11:46 PM

#

Probably your best bet would be to still bind to port 3000, and redirect the 443 port to it with firewalld

#

sudo firewall-cmd --direct --add-rule ipv4 nat OUTPUT 0 -p tcp --dport=443 -o lo -j REDIRECT --to-port=3000

idle island Dec 13, 2025, 12:10 AM

#

wintry sparrow `sudo firewall-cmd --direct --add-rule ipv4 nat OUTPUT 0 -p tcp --dport=443 -o l...

I added that rule and the equivalent for ipv6, too, but it is still not working

#

I mean

#

the sync

#

container is running fine and reachable from the browser

#

on both 3000 and 443 ports

wintry sparrow Dec 13, 2025, 12:12 AM

#

is it reachable by another machine too?

idle island Dec 13, 2025, 12:14 AM

#

3000 port is reachable but not 443 from another machine's browser on my LAN

wintry sparrow Dec 13, 2025, 12:15 AM

#

That would probably be why

#

You probably need to add another rule to allow it with your firewall

#

Oh

#

The command I gave you does seem to bind just to lo

#

I don't know enough about firewall-cmd to know offhand the syntax to know if -o lo is just for the target interface or the source

idle island Dec 13, 2025, 8:59 AM

#

I lowered the unprivileged port number so I can bind to 443 directly just for testing

#

I still can't sync somehow

#

and I am running the container in port 443

#

and it is reachable from other devices' browsers

#

Do I have to reboot the reMarkable or something?

wintry sparrow Dec 13, 2025, 9:05 AM

#

What OS version?

idle island Dec 13, 2025, 9:05 AM

#

3.24

wintry sparrow Dec 13, 2025, 9:06 AM

#

Try adding webapp-prod.cloud.remarkable.engineering to /etc/hosts

#

Although you might be encountering https://github.com/ddvk/rmfakecloud/issues/408

#

Assuming the issue is that 3.24.0 syncing is broken

idle island Dec 13, 2025, 9:08 AM

#

different message

#

now that I added that line

#

"The connection to our servers is not secure. Please try again, or connect to a different Wi-Fi."

#

I thought I had added the ca.crt?

wintry sparrow Dec 13, 2025, 9:09 AM

#

Did you ever validate it?

idle island Dec 13, 2025, 9:09 AM

#

I ran this update-ca-certificates. Is that what you mean by "validate"?

wintry sparrow Dec 13, 2025, 9:10 AM

#

No

#

I meant validate that it was added

#

and working

idle island Dec 13, 2025, 9:10 AM

#

How should I do it?

wintry sparrow Dec 13, 2025, 9:11 AM

#

openssl verify cert.pem will verify if the pem file was created with a trusted ca

idle island Dec 13, 2025, 9:11 AM

#

Do I run that from the same dir as my ca.cert?

wintry sparrow Dec 13, 2025, 9:11 AM

#

No

#

Your ca is installed in the system

#

you are checking to see if the system trusts the ca or not

idle island Dec 13, 2025, 9:12 AM

#

root@reMarkable:~# openssl verify cert.pem 
Could not open file or uri for loading certificate file from cert.pem: No such file or directory

wintry sparrow Dec 13, 2025, 9:13 AM

#

cert.pem needs to exist

#

so use the path to cert.pem

#

I guess you've actually called it proxy.cert?

idle island Dec 13, 2025, 9:14 AM

#

yes

#

no

#

ca.crt

#

for the one on the device

wintry sparrow Dec 13, 2025, 9:14 AM

#

No, that's a different thing

#

the certificate authority (ca) is the key used to generate the certificate used by the server

#

You are validating that your device trusts the certificate used by the server, because you've installed the ca to your device as a trusted certificate

idle island Dec 13, 2025, 9:16 AM

#

I have proxy.crt on my server

wintry sparrow Dec 13, 2025, 9:17 AM

#

Okay, you need the public certificate on your device so you can check to see if it's trusted

idle island Dec 13, 2025, 9:17 AM

#

Where do I add it?

#

any folder?

wintry sparrow Dec 13, 2025, 9:18 AM

#

Yes, any folder. I recommend in /tmp or /home as you will be removing it after you are done

idle island Dec 13, 2025, 9:18 AM

#

I have both proxy.crt and ca.crt on my server, in case I can also verify from there

wintry sparrow Dec 13, 2025, 9:18 AM

#

You can't verify from your server

#

Your server is not your device, which is what you are verifying

idle island Dec 13, 2025, 9:19 AM

#

/home/root/ ?

wintry sparrow Dec 13, 2025, 9:19 AM

#

Any folder

idle island Dec 13, 2025, 9:19 AM

#

not working yet

idle island Dec 13, 2025, 9:20 AM

#

idle island ``` root@reMarkable:~# openssl verify cert.pem Could not open file or uri for l...

same message

wintry sparrow Dec 13, 2025, 9:20 AM

#

That would be because the file you copied accross is not named cert.pem

#

change the command to use the path to the file

idle island Dec 13, 2025, 9:21 AM

#

root@reMarkable:~# openssl verify proxy.crt
proxy.crt: OK

wintry sparrow Dec 13, 2025, 9:22 AM

#

It's trusted

#

You can remove the file from your device now

wintry sparrow Dec 13, 2025, 9:23 AM

#

idle island "The connection to our servers is not secure. Please try again, or connect to a ...

Is this from the logs, or from the UI?

idle island Dec 13, 2025, 9:23 AM

#

UI

wintry sparrow Dec 13, 2025, 9:24 AM

#

Does the logs give you any other information

idle island Dec 13, 2025, 9:24 AM

#

what command for rm's logs?

wintry sparrow Dec 13, 2025, 9:24 AM

#

journalctl -fau xochitl will follow the main application's logs

#

journalctl -fau rm-sync for the sync engine

idle island Dec 13, 2025, 9:25 AM

#

It does give more information

📎 message.txt

#

oh, I think I must generate the cert again while adding that line to the config

wintry sparrow Dec 13, 2025, 9:26 AM

#

What line?

#

I'm seeing the correct subjects

#

The issuer certificate of a locally looked up certificate could not be found

#

Something about the certificate setup is incorrect

idle island Dec 13, 2025, 9:29 AM

#

when making the cert, I had a file created by this command

cat <<EOF > csr.conf
[ req ]
default_bits = 2048
default_keyfile = proxy.key
encrypt_key = no
default_md = sha256
prompt = no
utf8 = yes
distinguished_name = dn
req_extensions = ext
x509_extensions = caext

[ dn ]
C = AA
ST = QQ
L = JJ
O  = the culture
CN = *.appspot.com

[ ext ]
subjectAltName=@san
basicConstraints=CA:FALSE
subjectKeyIdentifier = hash


[ caext ]
subjectAltName=@san

[ san ]
DNS.1 = *.appspot.com
DNS.2 = *.remarkable.com
DNS.3 = *.cloud.remarkable.com
DNS.4 = *.cloud.remarkable.engineering
DNS.5 = *.rmfakecloud.localhost
DNS.6 = *.internal.cloud.remarkable.com
DNS.7 = *.tectonic.remarkable.com
DNS.8 = *.ping.remarkable.com
DNS.9 = *.internal.tctn.cloud.remarkable.com
EOF

I'm thinking of adding another entry for DNS.10 and the line for web...
But I just realised that DNS.4 must emcompass that

idle island Dec 13, 2025, 9:30 AM

#

wintry sparrow `The issuer certificate of a locally looked up certificate could not be found`

Is that for the place of ca.crt?

wintry sparrow Dec 13, 2025, 9:31 AM

#

That's the error message from the logs you posted

#

Is the ca.crt the same one that you used to generate the certificate used by rmfakecloud?

idle island Dec 13, 2025, 9:36 AM

#

yes

wintry sparrow Dec 13, 2025, 9:36 AM

#

and you've placed it in /usr/local/share/ca-certificates on the device?

#

I see logs of you running update-ca-certificates, but not of it being put into the folder

idle island Dec 13, 2025, 9:38 AM

#

it is in the folder

#

I placed it with nautilus via sftp

wintry sparrow Dec 13, 2025, 9:39 AM

#

has xochitl been restarted since you've done this?

idle island Dec 13, 2025, 9:39 AM

#

I don't think so

wintry sparrow Dec 13, 2025, 9:39 AM

#

I don't think it's required, but still good to test

#

alright, restart it: systemctl restart xochitl

#

maybe rm-sync too

idle island Dec 13, 2025, 9:41 AM

#

nice

#

it synced

#

I wonder whether I'll have the same problems as the other github issue

wintry sparrow Dec 13, 2025, 9:42 AM

#

If you do, please add a comment to the issue

idle island Dec 13, 2025, 9:47 AM

#

I don't seem to have issues syncing at least by adding new documents. I even restarted the device to check.

#

Added another document and still no issues

#

Do I add a reply to that GitHub issue so people have an easier time reproducing the mistake? I suppose it might be their rmfakecloud's version

wintry sparrow Dec 13, 2025, 9:50 AM

#

Probably best to leave it for now

#

I'm still waiting on their next reply

idle island Dec 13, 2025, 9:53 AM

#

How do I check my rmfakecloud's version?

#

I blocked the pull, so I don't know if I'm running 0.0.27 or 0.0.26

wintry sparrow Dec 13, 2025, 9:55 AM

#

Compare the image id

idle island Dec 13, 2025, 9:56 AM

#

Given that now a new line is needed for the hosts, that github issue might be what your pull request is after

wintry sparrow Dec 13, 2025, 9:57 AM

#

The user in the issue does have the new line in the hosts file though

#

So I'm not sure

idle island Dec 13, 2025, 9:59 AM

#

this is my image ID: 379734319d78. What do I compare it against?

wintry sparrow Dec 13, 2025, 9:59 AM

#

The one in dockerhub

idle island Dec 13, 2025, 9:59 AM

#

It says 6 weeks old so I assume it is older than 0.0.27.

idle island Dec 13, 2025, 9:59 AM

#

wintry sparrow The one in dockerhub

is it the sha thing?

wintry sparrow Dec 13, 2025, 10:00 AM

#

That's the digest

idle island Dec 13, 2025, 10:00 AM

#

Where is the ID?

wintry sparrow Dec 13, 2025, 10:02 AM

#

I guess it's not visible, you can check your digest then instead

#

it's 3am so I will not be responding while I'm asleep

#Where to place proxy.crt and proxy.key, rmfakecloud manual device setup