HTTPS for NetherNet

Geyser's built-in signaling server uses plain HTTP by default. Over plain HTTP, Minecraft cannot verify which server it is talking to, so it prompts each Bedrock player on the first join whether they want to trust the server the first time they join ("trust on first use"). Over HTTPS, the server's certificate proves its identity, so Minecraft does not show this prompt.

This page is for people who host Geyser themselves. When using a hosting provider, ask your host instead for how you could use HTTPS. To learn what signaling is, read Preparing your Geyser server for NetherNet.

What you need​

1. A domain name that points to your server, like play.example.com. Players must connect with this name, not with an IP address, because the certificate is made for the name. If you do not have a domain, you could use a DDNS provider such as DuckDNS to obtain a free one, like myserver.duckdns.org.
2. A working NetherNet setup without HTTPS. Make sure players can join first, then add HTTPS.
3. A certificate for that domain. If you already have one, you can use it as is. Otherwise, you could use Let's Encrypt to obtain one for free. The steps below do this with Caddy, certbot or win-acme, which need TCP port 80 to be reachable from the internet while obtaining and renewing certificates. Forward it in your router like your Geyser port. Let's Encrypt's DNS challenge works without port 80, but is not covered here.

Setting up HTTPS​

Geyser can serve HTTPS itself with a certificate set in its config. Alternatively, a reverse proxy such as Caddy or nginx can handle HTTPS in front of Geyser. If you would rather not manage a certificate at all, external signaling (mode: nxs) is an option as well, if the signaling service provides HTTPS: Warden does, but not every service does.

bedrock:
  signaling:
    builtin:
      https:
        certificate: /path/to/fullchain.pem
        private-key: /path/to/privkey.pem
        password: ''

bedrock:
  port: 19133
  webrtc-port: 19132

advanced:
  bedrock:
    signaling-trusted-proxies:
      - 127.0.0.1

{
	servers {
		# Caddy would otherwise use UDP 19132 for HTTP/3, which Geyser needs for playing
		protocols h1 h2
	}
}

play.example.com:19132 {
	reverse_proxy 127.0.0.1:19133
}

sudo systemctl enable --now caddy
# after changing the Caddyfile:
sudo systemctl reload caddy
# to see what Caddy is doing:
journalctl -xb -u caddy

.\caddy.exe run

sc.exe create caddy start= auto binPath= "C:\caddy\caddy.exe run --config C:\caddy\Caddyfile"
sc.exe start caddy

brew services start caddy
# after changing the Caddyfile:
brew services restart caddy

brew install nginx

echo "$(brew --prefix)/etc/nginx/servers/"

server {
    listen 19132 ssl;
    server_name play.example.com;

    ssl_certificate     /etc/letsencrypt/live/play.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/play.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:19133;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    listen 19132 ssl;
    server_name play.example.com;

    ssl_certificate     C:/nginx/certs/play.example.com-chain.pem;
    ssl_certificate_key C:/nginx/certs/play.example.com-key.pem;

    location / {
        proxy_pass http://127.0.0.1:19133;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    listen 19132 ssl;
    server_name play.example.com;

    ssl_certificate     /etc/letsencrypt/live/play.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/play.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:19133;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

sudo nginx -t && sudo systemctl reload nginx

cd C:\nginx
.\nginx.exe -t
.\nginx.exe -s reload

nginx -t && brew services restart nginx

Checking that it works​

1. Look at the Geyser console. With a certificate in the Geyser config, it says Built-in signaling started on https://. When using a reverse proxy, it says Built-in signaling started on http:// with port 19133.
2. On Bedrock, add the server with your domain name and port 19132. Join it: Minecraft should not ask whether you trust the server.