Install an SSL Certificate for Shinobi Using Let's Encrypt with Certbot and Cloudflare API Token

Steps to install a certificate from Let’s Encrypt using Cloudflare API Token

By subnet · May 22, 2025 · updated May 22, 2025

Using certbot to install a Let's Encrypt SSL cert with Clouflare API Token

Securing your Shinobi Video System with HTTPS is highly recommended for both privacy and security. This guide walks you through installing a free SSL certificate from Let’s Encrypt using Certbot, with DNS validation through the Cloudflare API — ideal even for LAN-only deployments.

Why Use Cloudflare DNS Validation?

Using the Cloudflare DNS plugin offers several advantages:

No need to open ports on your router or firewall
Works with local-only domains that are not publicly accessible
Fully automated via API token

The basic requirement, of course, is to have a domain that uses Cloudflare's name servers and to have created a token API according to their guides.

Note: All steps should be performed as root or using sudo.

Step-by-Step Guide

1. Update the system

apt-get update 
apt-get dist-upgrade

2. Install required packages

apt install -y certbot python3-certbot-dns-cloudflare

3. Create config directory and credentials file

mkdir -p /etc/cloudflare
chmod 700 /etc/cloudflare
touch /etc/cloudflare/shinobi.yourdomain.com.ini
chmod 600 /etc/cloudflare/shinobi.yourdomain.com.ini

4. Save your Cloudflare API token

echo "dns_cloudflare_api_token = YOUR_CLOUDFLARE_API_TOKEN" > /etc/cloudflare/shinobi.yourdomain.com.ini

(Replace YOUR_CLOUDFLARE_API_TOKEN with your actual Cloudflare token)

5. Request the SSL certificate

certbot certonly --register-unsafely-without-email \
  --dns-cloudflare \
  --dns-cloudflare-credentials /etc/cloudflare/shinobi.yourdomain.com.ini \
  -d shinobi.yourdomain.com \
  --dns-cloudflare-propagation-seconds 60

Let Certbot complete the domain validation and certificate issuance.

6. Stop Shinobi

pm2 stop /opt/Shinobi/camera.js && pm2 stop /opt/Shinobi/cron.js

7. Navigate to the Shinobi directory

cd /opt/Shinobi/

8. Edit the configuration

Open conf.json with your editor:

nano conf.json

Update the "ssl" section to:

"ssl": {
  "key":"/etc/letsencrypt/live/shinobi.yourdomain.com/privkey.pem",
  "cert":"/etc/letsencrypt/live/shinobi.yourdomain.com/fullchain.pem",
  "port": 443
}

Save and exit the editor (Ctrl + O, Enter, then Ctrl + X).

9. Restart Shinobi

pm2 start /opt/Shinobi/camera.js && pm2 start /opt/Shinobi/cron.js

Final Check

Visit your Shinobi instance at:

https://shinobi.yourdomain.com

You should now see your Shinobi dashboard secured with HTTPS!