HTTPS, names and certificates
The box works over plain HTTP. Two things need more: browser microphones (voice beyond listen-only) and installing the web app to a home screen. Both are browser security rules tied to HTTPS — so if you want them, the box needs a certificate, and a certificate needs a name.
If your crew uses the Android app for voice and nobody installs the web app, you can skip this whole page. iPhones then join by the box's IP address, which is what a box without a certificate advertises anyway: the iPhone app won't use a name over plain HTTP (why).
The two-names idea
One hostname can't serve both worlds, so crewbox's reference setup uses two:
| Name | Points at | Job |
|---|---|---|
A public name (like crewbox.example.com) | the internet | the download page — where you got the box |
A box name (like chat.example.com) | the box's LAN IP | what crew type; what the certificate is issued for |
The box name resolves to a private address on the event network — which is exactly why the venue's DNS has to be taught about it.
Getting the certificate on the box
Get a certificate for the box's name (a normal Let's Encrypt DNS-01 issuance works — it never needs the box reachable from the internet), then drop cert.pem and key.pem into the box's data directory and restart. The box serves TLS itself — no reverse proxy, nothing else to install.
Two forgiving behaviours worth knowing:
- Broken or expired material never stops the box. It logs why, serves plain HTTP, and the readiness list says what's wrong. A certificate problem on show day costs you browser mic, not comms.
- With a certificate installed, the box advertises its name first — the startup banner, the browser it opens for you and the menu-bar/tray item all lead with
https://chat.example.com, because raw IPs fail the browser's name check. The plain addresses stay listed after it, since the name only resolves once the network's DNS override exists. - The
/connectpage is the exception, and deliberately so: its QR encodes whatever address you used to reach it. That is what makes it right on a laptop, a phone and through a tunnel alike — but it means a poster printed from/connectopened athttps://192.168.1.10:8787sends crew to an address their browsers will not give a microphone to. Open it at the box's name before you print.
Making the name resolve on site
Crew phones must resolve the box name to the box's LAN IP with no internet. In order of preference:
- The venue router speaks dnsmasq (most do): add one line mapping the name to the box's IP. Admin → This network generates exactly this file when it detects the name isn't resolving — download, hand to whoever runs the router. For a MikroTik, Download for MikroTik gives the same entry as a RouterOS script.
- Your own event router: same line, your own kit, no venue conversation.
- No DNS control at all: crew use the IP over plain HTTP — everything works except browser mic and install, and the readiness list says so honestly.
Checking it worked
Admin → This network is the scoreboard: the name check goes green when phones can resolve the box, the certificate row shows expiry, and Admin → This box shows voice fully working once browsers can get a microphone. Certificate expiring mid-run? Renew before the event — the readiness list starts warning as expiry approaches.