> For the complete documentation index, see [llms.txt](https://docs.hivel.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hivel.ai/self-managed-hivel-deployment/virtual-private-cloud/aws/dns-setup-aws/setup-and-prerequisites/advanced-temporary-option-b-no-domain-yet-self-signed.md).

# Advanced / temporary - Option B: No Domain Yet (Self-Signed)

DNS Setup (AWS)

### When to Use This Option?

Use this only for testing before DNS/domain setup is complete.

{% hint style="warning" %}
**Warning:** Not recommended for client-facing production use. Browsers will show an untrusted-certificate warning.
{% endhint %}

***

### Step 1: Configure Caddy for Self-Signed Certificates

**On the VM:**

Create the Caddy configuration file:

```
mkdir -p ~/caddy && cd ~/caddy

cat > Caddyfile <<'EOF'
:443 {
    tls internal
    reverse_proxy localhost:3000
}
EOF
```

The `tls internal` directive tells Caddy to generate a self-signed certificate (no Let's Encrypt challenge needed).

***

#### Step 2: Start Caddy

**On the VM:**

```
docker run -d --name caddy --restart unless-stopped --network host \
  -v $(pwd)/Caddyfile:/etc/caddy/Caddyfile \
  -v caddy_data:/data \
  caddy:2
```

**Expected result:** `docker ps | grep caddy` shows the container as Up.

***

#### Step 3: Open Port 443

**In AWS Console (EC2 Security Group):**

1. Go to EC2 > Security Groups
2. Select your VM's security group
3. Add an inbound rule:
   * **Type:** Custom TCP
   * **Port:** 443
   * **Source:** 0.0.0.0/0

**Note:** Port 80 is not required for this option (no ACME challenge needed).

***

#### Step 4: Access the UI

**In your browser, navigate to:**

```
https://<vm-public-ip>
```

Replace `<vm-public-ip>` with your VM's public IP address from AWS Console.

**Browser warning:** You'll see an "untrusted certificate" warning because the certificate is self-signed.

* Click **Advanced**
* Click **Proceed** (or equivalent button in your browser)

The page loads over HTTPS, which satisfies the secure-context requirement for APIs like `crypto.randomUUID`.

**Next Steps: This setup is temporary.** As soon as you have a domain available, upgrade to Option A: Domain + Let's Encrypt for a trusted certificate.

See [Upgrading from Option B to Option A](/self-managed-hivel-deployment/virtual-private-cloud/aws/dns-setup-aws/setup-and-prerequisites/upgrading-from-option-b-to-option-a.md) for migration steps.<br>

{% columns %}
{% column %} <a href="/self-managed-hivel-deployment/virtual-private-cloud/aws/dns-setup-aws/setup-and-prerequisites/recommended-option-a-domain-+-lets-encrypt.md" class="button primary" data-icon="backward">Back to Option A: Domain + Let's Encrypt</a>
{% endcolumn %}

{% column %}

{% endcolumn %}

{% column %} <a href="/self-managed-hivel-deployment/virtual-private-cloud/aws/dns-setup-aws/setup-and-prerequisites/upgrading-from-option-b-to-option-a.md" class="button primary" data-icon="forward">Upgrading B → A</a>
{% endcolumn %}
{% endcolumns %}