DietPi-Dashboard with Let's Encrypt Certificate

Troubleshooting
,
1

Creating a bug report/issue

I have searched the existing open and closed issues

Required Information

  • DietPi version: G_DIETPI_VERSION_CORE=10, G_DIETPI_VERSION_SUB=1, G_DIETPI_VERSION_RC=2
  • Distro version: Raspbian GNU/Linux 13 (trixie), DEBIAN_VERSION_FULL=13.2
  • Kernel version: Raspbian 1:6.12.62-1+rpt1 (2025-12-18) armv6l GNU/Linux
  • Architecture: armhf (and others)
  • SBC model: RPi B (armv6l) and others

Additional Information (if applicable)

  • Software title: DietPi-Dashboard (200), Certbot (92)
  • Was the software title installed freshly or updated/migrated? reinstalled (dietpi-software reinstall 92 200)
  • Can this issue be replicated on a fresh installation of DietPi? On all of my Raspberry Pis and virtual machines
  • Bug report ID: 6a7cdb07-b51c-4a01-94cc-327b705a3ea0

Steps to reproduce

Hello Guys,

I tried to run dietpi-dashboard on serveral Pis with my Let’s Encrypt Certificates, to get rid of the “Warning, not secure” message in the browser with the default certificate.
To do so, I edited in the file ‘/opt/dietpi-dashboard/config-frontend.toml’ the following lines:

‘# Path to TLS certificate
’# changed default: cert_path = “/opt/dietpi-dashboard/cert.pem” to
cert_path = “/etc/letsencrypt/live/my-pi-name.my-domain-name.tld/cert.pem”
’# changed default: key_path = “/opt/dietpi-dashboard/privkey.pem” to
key_path = “/etc/letsencrypt/live/my-pi-name.my-domain-name.tld/privkey.pem”

After restarting the frontend of dietpi-dashboard my browser gets no connection to the dashboard.
Restarting the Raspberry Pi didn’t solve the problem either:

Connection failed
Firefox can’t establish a connection to the server at my-pi-name.my-domain-name.tld:5252.

The certificate is running perfectly fine with Pi-Hole (thank you very much to: https://www.reddit.com/r/pihole/comments/1n3e0t6/utiliser_un_certificat_lets_encrypt_avec_pihole_v6/?tl=en ),
after editing /etc/pihole/pihole.toml:

[webserver.tls]
’# changed default cert = “/etc/pihole/tls.pem” to
cert = “/etc/pihole/letsencrypt.pem”

and creating & running the new file /etc/letsencrypt/renewal-hooks/post/pihole.sh:

#!/bin/bash
cat /etc/letsencrypt/live/my-pi-name.my-domain-name.tld/fullchain.pem /etc/letsencrypt/live/my-pi-name.my-domain-name.tld/privkey.pem > /etc/letsencrypt/live/my-pi-name.my-domain-name.tld/letsencrypt.pem
mv /etc/letsencrypt/live/my-pi-name.my-domain-name.tld/letsencrypt.pem /etc/pihole/
chown pihole:pihole /etc/pihole/letsencrypt.pem

So the issue can’t be due to the Let’s Encrypt Certificate.
Therefore, I checked the status of dietpi-dashboard-frontend:

root@my-pi-name:~# systemctl status dietpi-dashboard-frontend
× dietpi-dashboard-frontend.service - Dashboard Web Server (DietPi)
     Loaded: loaded (/etc/systemd/system/dietpi-dashboard-frontend.service; enabled; preset: enabled)
     Active: failed (Result: exit-code) since Tue 2026-03-03 15:29:27 CET; 4s ago
   Duration: 625ms
 Invocation: aab7ab1483264d84a41ce5419406cac4
    Process: 1909 ExecStart=/opt/dietpi-dashboard/frontend (code=exited, status=1/FAILURE)
   Main PID: 1909 (code=exited, status=1/FAILURE)
        CPU: 533ms

Mär 03 15:29:26 PiHole1 systemd[1]: Started dietpi-dashboard-frontend.service - Dashboard Web Server (DietPi).
Mär 03 15:29:27 PiHole1 frontend[1909]: 2026-03-03T14:29:27.567Z INFO  [frontend] Starting DietPi-Dashboard frontend v0.7.0...
Mär 03 15:29:27 PiHole1 frontend[1909]: 2026-03-03T14:29:27.571Z INFO  [frontend::backend] Starting backend server on port 5253
Mär 03 15:29:27 PiHole1 frontend[1909]: 2026-03-03T14:29:27.571Z INFO  [frontend::http] Starting web server on port 5252
Mär 03 15:29:27 PiHole1 frontend[1909]: Error: failed to build TlsAcceptor
Mär 03 15:29:27 PiHole1 frontend[1909]: Caused by:
Mär 03 15:29:27 PiHole1 frontend[1909]:     0: failed to read file
Mär 03 15:29:27 PiHole1 frontend[1909]:     1: Permission denied (os error 13)
Mär 03 15:29:27 PiHole1 systemd[1]: dietpi-dashboard-frontend.service: Main process exited, code=exited, status=1/FAILURE
Mär 03 15:29:27 PiHole1 systemd[1]: dietpi-dashboard-frontend.service: Failed with result 'exit-code'.
root@my-pi-name:~#

In addition, I performed the following checks:

  1. no response by running the following command:
root@my-pi-name:~# ss -tulp | grep ‘525’
root@my-pi-name:~#
  1. connection refused by running the following command:
root@my-pi-name:~# curl -v https://localhost:5252
* Host localhost:5252 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:5252...
* Immediate connect fail for ::1: Die angeforderte Adresse kann nicht zugewiesen werden
*   Trying 127.0.0.1:5252...
* connect to 127.0.0.1 port 5252 from 127.0.0.1 port 42830 failed: Verbindungsaufbau abgelehnt
* Failed to connect to localhost port 5252 after 7 ms: Could not connect to server
* closing connection #0
curl: (7) Failed to connect to localhost port 5252 after 7 ms: Could not connect to server
root@my-pi-name:~#
  1. checking IPv6 with the following command:
root@my-pi-name:~# sysctl net.ipv6.bindv6only
net.ipv6.bindv6only = 0
root@my-pi-name:~#

But that didn’t get me anywhere.

Expected behaviour

So I can’t figure it out, why dietpi-dashboard-frontend is failing with the Let’s Encrypt Certificate.

Any Ideas? Thank you in advance for any tips.

2

The frontend cannot read the cert. You would need to adjust the permissions of the cert

1 Like
3

Thank you so much! That was it! Sometimes the solution can be so simple.

Because I think that adjusting the permissions in the Let’s Encrypt folder could lead to other issues, I added the following script to /etc/letsencrypt/renewal-hooks/post/:

#!/bin/bash
cp /etc/letsencrypt/live/my-pi.my-domain-name.tld/cert.pem /opt/dietpi-dashboard/letsencrypt-cert.pem
cp /etc/letsencrypt/live/my-pi.my-domain-name.tld/privkey.pem /opt/dietpi-dashboard/letsencrypt-privkey.pem
chown dietpi-dashboard-frontend:root /opt/dietpi-dashboard/letsencrypt-cert.pem
chown dietpi-dashboard-frontend:root /opt/dietpi-dashboard/letsencrypt-privkey.pem

and edited the file /opt/dietpi-dashboard/config-frontend.toml as follows (without the ‘ before the #):

‘# Path to TLS certificate
’# changed default cert_path = “/opt/dietpi-dashboard/cert.pem” to
cert_path = “/opt/dietpi-dashboard/letsencrypt-cert.pem”
’# Path to TLS private key
’# changed default key_path = “/opt/dietpi-dashboard/privkey.pem” to
key_path = “/opt/dietpi-dashboard/letsencrypt-privkey.pem”

Now everything works fine!
Thank you!