crwdns33060:0crwdne33060:0

HTTPS for NetherNet

Geyser's built-in signaling server uses plain HTTP by default. Over plain HTTP, Minecraft cannot verify which server it is talking to, so it prompts each Bedrock player on the first join whether they want to trust the server the first time they join ("trust on first use"). Over HTTPS, the server's certificate proves its identity, so Minecraft does not show this prompt.

This page is for people who host Geyser themselves. When using a hosting provider, ask your host instead for how you could use HTTPS. To learn what signaling is, read Preparing your Geyser server for NetherNet.

Only for built-in signaling

This page only matters if you use Geyser's built-in signaling: mode in the signaling section is builtin (the default) or hybrid.

What you need​

  1. A domain name that points to your server, like play.example.com. Players must connect with this name, not with an IP address, because the certificate is made for the name. If you do not have a domain, you could use a DDNS provider such as DuckDNS to obtain a free one, like myserver.duckdns.org.
  2. A working NetherNet setup without HTTPS. Make sure players can join first, then add HTTPS.
  3. A certificate for that domain. If you already have one, you can use it as is. Otherwise, you could use Let's Encrypt to obtain one for free. The steps below do this with Caddy, certbot or win-acme, which need TCP port 80 to be reachable from the internet while obtaining and renewing certificates. Forward it in your router like your Geyser port. Let's Encrypt's DNS challenge works without port 80, but is not covered here.

Setting up HTTPS​

Geyser can serve HTTPS itself with a certificate set in its config. Alternatively, a reverse proxy such as Caddy or nginx can handle HTTPS in front of Geyser. If you would rather not manage a certificate at all, external signaling (mode: nxs) is an option as well, if the signaling service provides HTTPS: Warden does, but not every service does.

Geyser serves HTTPS on the same port as HTTP, so no extra program is needed. Geyser reads the certificate when it starts, so it needs a restart after every renewal.

1. Obtain a certificate

If you already have a certificate for your domain, skip this step. Otherwise, you could use Let's Encrypt to obtain one, for example with certbot or win-acme. These need TCP port 80 to be reachable.

On Linux, certbot is the recommended way to obtain certificates from Let's Encrypt. Follow the instructions over at certbot's website to see how.

2. Configure Geyser

Set the files in the signaling section of the Geyser config. With win-acme, use the -chain.pem and -key.pem files instead.

bedrock:
  signaling:
    builtin:
      https:
        certificate: /path/to/fullchain.pem
        private-key: /path/to/privkey.pem
        password: ''
  • Paths can be relative to Geyser's config folder, or absolute.
  • A PKCS12 file (.p12 or .pfx) works as well: put it in certificate, leave private-key empty, and set its password. Use file:/path/to/password.txt to keep the password out of the config.
Restart after renewing

Geyser reads the certificate when it starts. After a renewal, restart the server or run geyser reload, or players will get an expired certificate.

Then open your ports, restart your Minecraft server, and check that it works.

Opening ports​

Forward these in your router, and allow them in your firewall:

  • TCP 80: only if you obtain certificates through Let's Encrypt as described above
  • TCP 19132: signaling (HTTPS)
  • UDP 19132: playing

With a reverse proxy, port 19133 stays inside your machine. Do not open it.

With ufw:

sudo ufw allow 80/tcp && sudo ufw allow 19132/tcp && sudo ufw allow 19132/udp

With firewalld:

sudo firewall-cmd --permanent --add-port=80/tcp --add-port=19132/tcp --add-port=19132/udp && sudo firewall-cmd --reload

If you use nftables or iptables directly, you probably know how to do this by yourself anyway.

See port forwarding for help with your router.

Checking that it works​

  1. Look at the Geyser console. With a certificate in the Geyser config, it says Built-in signaling started on https:// and http://. When using a reverse proxy, it says Built-in signaling started on http:// with port 19133.
  2. On Bedrock, add the server with your domain name and port 19132. Join it: Minecraft should not ask whether you trust the server.
What you seeWhat to do
Players still get the trust promptMake sure they use the domain name, not the IP address.
Console: "Built-in signaling could not start. Make sure no other program is using TCP port …" after adding a certificateUsually a wrong file path or password. Turn on debug-mode in the config and restart to see the real reason.
Caddy or certbot cannot get a certificateCheck that TCP port 80 is forwarded to this machine, and that your domain points to your current IP.
Server shows up, but joining times outUDP 19132 is not reachable, or Caddy uses it. Check the protocols h1 h2 line, and your firewall.