It is appropriate to continue using ssl_certificate /etc/kvmd/nginx/ssl/server.crt ; ssl_certificate_key /etc/kvmd/nginx/ssl/server.key ; in /etc/kvmd/nginx/ssl.conf , with a systemd timer checking the certificate expiration and updating these two files only when necessary. The official PiKVM documentation also describes placing the Tailscale certificate in /etc/kvmd/nginx/ssl/server.{crt,key} , setting the group to kvmd-nginx , and then restarting kvmd-nginx ....