Pi-hole uses HTTP by default, but you can switch to HTTPS to encrypt the connection between your devices and the admin dashboard

Pi-hole's web interface runs on your local network, which means traffic between your devices and the dashboard travels unencrypted by default. Enabling HTTPS adds a layer of encryption so that anyone on your network cannot see what you are doing in the admin panel — including password entry, DNS query logs, or configuration changes. This matters most if you share your network with people you do not fully trust, or if you want to follow security best practices even on a home network.

The process involves creating or obtaining an SSL certificate, then pointing Pi-hole to use it. You have two main routes: generate a self-signed certificate (free, takes 10 minutes, but your browser will warn you it is not from a trusted authority) or use a certificate from Let's Encrypt (free, more trusted-looking, but requires a domain name and a bit more setup). Most home users choose self-signed and dismiss the browser warning each time they log in.

Key Takeaways

  • A self-signed certificate takes about 10 minutes to create and requires only the command line on your Pi-hole machine — no external services needed.
  • Your browser will show a security warning for a self-signed certificate every time you visit, but the connection is still encrypted.
  • Let's Encrypt certificates look trusted to browsers but require you to own a domain name and run a certificate renewal script every 90 days.
  • After enabling HTTPS, update your Pi-hole address in any devices or apps that connect to it, because HTTP and HTTPS use different ports.
  • The admin password is still the only real barrier to someone accessing your dashboard — HTTPS only encrypts the path between your device and Pi-hole.

Creating a self-signed certificate in five steps

A self-signed certificate is the fastest route. Log into your Pi-hole machine via SSH (or open a terminal if you are using a desktop Linux install), then run these commands in order. Replace pihole.local with whatever hostname or IP address you actually use to reach your Pi-hole dashboard.

First, create a directory to hold the certificate files:

mkdir -p /etc/pihole/certs

Next, generate the certificate and private key in one command. This creates two files that will live in that directory for as long as you run Pi-hole:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/pihole/certs/pihole.key -out /etc/pihole/certs/pihole.crt -subj "/CN=pihole.local"

Change pihole.local in that command to match the address you use. The certificate will be valid for 365 days; after that, you can run the same command again to generate a new one.

Now tell the Pi-hole web server where to find these files. Open the lighttpd configuration file in a text editor:

sudo nano /etc/lighttpd/external.conf

Add these lines to the file (if the file is empty, just paste them in):

$SERVER["socket"] == ":443" { ssl.engine = "enable" ssl.pemfile = "/etc/pihole/certs/pihole.crt" ssl.privkey = "/etc/pihole/certs/pihole.key" }

Save the file (Ctrl+O, then Enter, then Ctrl+X in nano), then restart lighttpd:

sudo systemctl restart lighttpd

Visit your Pi-hole dashboard at https://pihole.local (note the https). Your browser will warn you that the certificate is not trusted — this is expected. Click "Advanced" or "More Information" and then "Proceed anyway" or "Accept the risk". You will see this warning every time you visit, because the certificate is self-signed.

Using Let's Encrypt for a trusted certificate

If you own a domain name and want your browser to trust the certificate without warnings, Let's Encrypt is free and widely used. This path requires that your Pi-hole machine can reach the internet and that you can point a DNS record to it (or use a wildcard certificate). The setup is more involved, but the certificate renews automatically.

Install Certbot, the tool that handles Let's Encrypt certificates:

sudo apt update && sudo apt install certbot

Request a certificate for your domain. Replace example.com with your actual domain and user@example.com with your email:

sudo certbot certonly --standalone -d example.com -d www.example.com --email user@example.com --agree-tos

Certbot will place the certificate and key files in /etc/letsencrypt/live/example.com/. Update your lighttpd configuration to point to those files instead:

sudo nano /etc/lighttpd/external.conf

Replace the previous SSL block with:

$SERVER["socket"] == ":443" { ssl.engine = "enable" ssl.pemfile = "/etc/letsencrypt/live/example.com/fullchain.pem" ssl.privkey = "/etc/letsencrypt/live/example.com/privkey.pem" }

Restart lighttpd:

sudo systemctl restart lighttpd

Set up automatic renewal so the certificate refreshes before it expires. Create a cron job:

sudo crontab -e

Add this line to run renewal every day at 2 AM:

0 2 * * * certbot renew --quiet && systemctl restart lighttpd

Your browser will now trust the certificate without warnings when you visit https://example.com.

Updating your devices and apps after enabling HTTPS

HTTPS uses port 443 instead of the default port 80 that HTTP uses. If you have configured other machines or apps to point to your Pi-hole, you need to update them.

If you access Pi-hole by IP address (for example, 192.168.1.100), change it to https://192.168.1.100 in your browser. If you use a hostname like pihole.local, change it to https://pihole.local. Some apps and devices that use Pi-hole as a DNS server do not need changes — they do not connect to the dashboard at all. But if you have set up conditional forwarding, ad-blocking rules that pull from a web source, or any other feature that requires the dashboard to be reachable, test those features after enabling HTTPS.

If an app or device lets you specify a port, you can also use https://pihole.local:443 or https://192.168.1.100:443, though the :443 is usually optional since HTTPS defaults to that port.

Troubleshooting HTTPS connection problems

If your browser cannot reach the dashboard after enabling HTTPS, the most common cause is that lighttpd did not restart cleanly. Check the status:

sudo systemctl status lighttpd

If it shows an error, the configuration file probably has a syntax mistake. Re-open the external.conf file and make sure the braces and quotes match exactly. A missing semicolon or mismatched quote will prevent lighttpd from starting.

If lighttpd is running but you still cannot connect, try accessing Pi-hole over HTTP (without the s) on port 80 to confirm the machine itself is reachable. If HTTP works but HTTPS does not, the certificate files may not exist or lighttpd cannot read them. Check that the paths in external.conf match where you actually created the certificate files, and that the lighttpd user has permission to read them:

sudo ls -la /etc/pihole/certs/

If the files are not there, go back and run the openssl command again. If they exist but lighttpd still cannot connect, run:

sudo chown lighttpd:lighttpd /etc/pihole/certs/*

Then restart lighttpd again.

Why HTTPS matters for Pi-hole, and what it does not protect

HTTPS encrypts the traffic between your browser and the Pi-hole dashboard, which means someone on your network cannot see your password, the queries you are looking at, or the settings you change. This is useful if you share your network with roommates, family members, or guests who might be curious or malicious.

HTTPS does not protect your DNS queries themselves — the queries that Pi-hole blocks or forwards still travel unencrypted between your devices and Pi-hole (unless you have separately configured DNS-over-HTTPS on your devices). HTTPS only protects the admin dashboard. It also does not replace a strong password; if someone knows your Pi-hole admin password, they can still log in and change everything, whether the connection is encrypted or not.

For most home networks, HTTPS on the dashboard is a good practice but not critical. It becomes more important if you access Pi-hole from outside your home network (for example, over a VPN), because then the traffic crosses the internet and could be intercepted.

Frequently Asked Questions

Do I have to choose between self-signed and Let's Encrypt, or can I switch later?

You can switch anytime. If you start with self-signed and later get a domain, just install Certbot, request a Let's Encrypt certificate, and update the lighttpd configuration to point to the new certificate files. Restart lighttpd and you are done. The process takes about 10 minutes.

What happens when my self-signed certificate expires after 365 days?

Your browser will show a different warning — that the certificate has expired. The connection is still encrypted, but the warning becomes more annoying. To fix it, run the openssl command again to generate a new certificate, then restart lighttpd. You can also change the 365 in the openssl command to a larger number like 3650 to make the certificate valid for 10 years.

Can I use HTTPS and still access Pi-hole over HTTP?

Yes. The lighttpd configuration can listen on both port 80 (HTTP) and port 443 (HTTPS) at the same time. Most people do this so they can use whichever one they remember. Both will work, but HTTPS is more find.

Will enabling HTTPS slow down my Pi-hole?

No. HTTPS only affects the dashboard connection, not the DNS blocking that Pi-hole does. The encryption overhead is negligible on a modern machine, even a Raspberry Pi.

What if I cannot remember whether I used pihole.local or my IP address when I created the certificate?

The certificate is tied to the name you put in the -subj field. If you created it for pihole.local but try to visit 192.168.1.100, your browser will warn you that the certificate does not match the address. You can create a second certificate for the IP address and configure lighttpd to use both, or just regenerate the original certificate with the correct address and restart lighttpd.