Deployment

DefectDojo SSL/TLS

Serve the optional DefectDojo instance over your own certificate.

This page covers TLS for the optional DefectDojo instance only. The ScanSuite console has its own certificate — see SSL/TLS Setup. DefectDojo and ScanSuite are separate installations, so each has its own domain name and certificate.

1. Register a domain name

Register a domain for DefectDojo in your DNS configuration, for example dojo.yourdomain.com.

2. Stop DefectDojo

Shell
cd ~/apps/scansuite/defectdojo && docker compose down -t 0

3. Obtain a certificate

Obtain a certificate from your local Certificate Authority. If the DefectDojo host is publicly accessible you can use Let's Encrypt instead — install Certbot if it is not already present:

Shell
sudo snap install certbot --classic
Shell
sudo certbot certonly --register-unsafely-without-email --agree-tos -d dojo.yourdomain.com

4. Replace the key and certificate

Copy the certificate and key to ~/apps/scansuite/defectdojo/certs. Ensure the file names nginx.crt and nginx.key are preserved.

DefectDojo certs directory listing
The DefectDojo certificate directory

Ensure both files are user readable, otherwise run:

Shell
cd ~/apps/scansuite/defectdojo/certs && chmod +r nginx.crt nginx.key

5. Start DefectDojo

Shell
cd ~/apps/scansuite/defectdojo && docker compose up -d

6. Verify the certificate loaded

Check the nginx logs to confirm the certificate loaded correctly:

Shell
cd ~/apps/scansuite/defectdojo && docker compose logs nginx

If any errors appear, double-check the certificate paths and permissions. A certificate managed by certbot lives outside the certs directory, so the nginx configuration has to point at it — see Setup parameters and services.

Last reviewed 2026-08-23