Fix Chrome's Missing Disk Cache on Unraid with mkcert

Chrome disables disk cache for untrusted HTTPS certs — and Unraid ships with one. A 5-minute mkcert fix makes the GUI feel instant.

The Hidden Performance Tax

If your Unraid GUI feels sluggish, the culprit might not be your server hardware — it's Chrome.Here's what happens: Unraid forces HTTPS with a self-signed certificate. Chrome sees the untrusted cert and silently disables disk cache for the entire site (Chromium bug #110649). Every page navigation re-downloads all CSS, JS, and images from scratch. On a dashboard with dozens of Docker container icons, that adds up fast.You can confirm this yourself: open DevTools → Network tab → navigate around. You'll see zero (disk cache) entries. Every request hits the server.

The Fix: mkcert

mkcert creates locally-trusted development certificates. It installs a local CA into your system trust store, then issues certs signed by that CA. Browsers trust them without warnings.

Setup (One-Time)

Bash

# macOS
brew install mkcert
mkcert -install  # adds local CA to System keychain

# Linux
sudo apt install mkcert  # or use go install
mkcert -install

# Windows
choco install mkcert
mkcert -install

Generate & Deploy

Bash

# Generate cert for all your Unraid access methods
# Replace with your server's IP, hostname, domain, Tailscale IP, etc.
mkcert -cert-file /tmp/unraid.pem -key-file /tmp/unraid-key.pem \
  "unraid.example.com" "192.168.1.100" "Tower.local"

# Unraid expects a PEM bundle (cert + key concatenated)
# Filename must be {ServerName}_unraid_bundle.pem
cat /tmp/unraid.pem /tmp/unraid-key.pem > /tmp/Tower_unraid_bundle.pem

# Backup the original cert, then deploy
ssh your-unraid "cp /boot/config/ssl/certs/Tower_unraid_bundle.pem \
  /boot/config/ssl/certs/Tower_unraid_bundle.pem.bak"
scp /tmp/Tower_unraid_bundle.pem \
  your-unraid:/boot/config/ssl/certs/Tower_unraid_bundle.pem

# Reload nginx — no reboot needed
ssh your-unraid "nginx -t && nginx -s reload"

Important: Replace Tower with your actual Unraid server name (Settings → Identification). The cert bundle filename must match the pattern {ServerName}_unraid_bundle.pem.

Verify

Bash

# Check the cert chain
echo | openssl s_client -connect 192.168.1.100:443 \
  -CAfile "$(mkcert -CAROOT)/rootCA.pem" 2>&1 | grep "Verify return"
# Expected: Verify return code: 0 (ok)

Then fully restart Chrome (Cmd+Q on Mac, not just close tab) and visit your Unraid URL. You should see:

✅ "Certificate is valid" in the site info popup
✅ (disk cache) entries in the Network tab on second load

Before & After

	Self-signed cert	mkcert cert
Chrome trust	❌ "Not Secure"	✅ "Certificate is valid"
Disk cache	❌ Disabled	✅ Enabled
Page reload	Re-downloads everything	Instant (cached assets)
Dashboard feel	Sluggish	Snappy

Gotchas

Unraid OS updates may overwrite the cert. The cert lives on the USB flash drive at /boot/config/ssl/certs/. Major Unraid updates could regenerate the default self-signed cert. Just re-run the deploy step.mkcert CA is per-machine. Each device that accesses Unraid needs its own mkcert -install. The CA is stored locally and not distributed automatically. For multi-device households, you could copy the root CA to other machines, but that's a security tradeoff."Not Secure" badge may persist even with a valid cert. If Docker container icons load over plain HTTP, Chrome shows a mixed-content warning. The cert is still working — disk caching is enabled. You can verify in DevTools → Security tab.curl won't trust it by default. The mkcert CA is in your browser/OS trust store, not curl's. Use --cacert "$(mkcert -CAROOT)/rootCA.pem" for CLI verification.

Renewal

mkcert certs expire in about 2 years 3 months. When it's time, just regenerate and redeploy — same commands as above.

When to Use Something Else

mkcert is for LAN access only. For remote access, use a proper reverse proxy with Let's Encrypt or Cloudflare certificates. Tools like Nginx Proxy Manager or Caddy handle this well and provide publicly trusted certs that work everywhere.

Let AI Do It

If you use an AI coding assistant like OpenCode, paste this prompt and let it handle everything:

Bash

I want to set up mkcert SSL for my Unraid server to fix Chrome's disk cache issue.
Reference: https://mjshao.fun/blog/mkcert-unraid-ssl

My setup:
- Unraid IP: [ask me]
- Server name: [ask me]
- SSH alias/config: [ask me]
- Extra SANs (domain, Tailscale IP, etc.): [ask me]

Steps:
1. Install mkcert if not present (brew/apt/choco based on my OS)
2. Run mkcert -install if local CA not yet trusted
3. Generate cert with all my SANs
4. Create PEM bundle in {ServerName}_unraid_bundle.pem format
5. Backup existing cert on Unraid, deploy new one via scp
6. Reload nginx on Unraid, verify with openssl s_client
7. Remind me to fully restart Chrome (Cmd+Q / full exit)

Chrome 对不受信任的 HTTPS 证书会悄悄禁用磁盘缓存——而 Unraid 自带的就是这种证书。用 mkcert 花 5 分钟搞定，GUI 立马飞起。

隐藏的性能税

如果你的 Unraid 管理界面用着总觉得慢，问题可能不在服务器配置——而在 Chrome。事情是这样的：Unraid 强制走 HTTPS，但用的是自签名证书。Chrome 一看证书不受信任，就悄悄禁用了整个站点的磁盘缓存（Chromium bug #110649）。每次页面切换都要重新下载所有 CSS、JS 和图片。Dashboard 上那几十个 Docker 容器图标，每次都要全部重新加载。验证方法：打开 DevTools → Network 标签 → 随便点几个页面。你会发现完全没有 (disk cache) 的请求，全是从服务器重新拉的。

方案：mkcert

mkcert 可以创建本地受信任的开发证书。它在系统信任存储里装一个本地 CA，然后签发由这个 CA 背书的证书。浏览器直接信任，没有警告。

初始设置（一次性）

Bash

# macOS
brew install mkcert
mkcert -install  # 把本地 CA 加到系统钥匙串

# Linux
sudo apt install mkcert  # 或者 go install
mkcert -install

# Windows
choco install mkcert
mkcert -install

生成并部署

Bash

# 生成覆盖所有访问方式的证书
# 把下面替换成你的服务器 IP、主机名、域名等
mkcert -cert-file /tmp/unraid.pem -key-file /tmp/unraid-key.pem \
  "unraid.example.com" "192.168.1.100" "Tower.local"

# Unraid 需要 PEM bundle 格式（证书+密钥拼在一起）
# 文件名必须是 {服务器名}_unraid_bundle.pem
cat /tmp/unraid.pem /tmp/unraid-key.pem > /tmp/Tower_unraid_bundle.pem

# 备份原证书，然后部署
ssh your-unraid "cp /boot/config/ssl/certs/Tower_unraid_bundle.pem \
  /boot/config/ssl/certs/Tower_unraid_bundle.pem.bak"
scp /tmp/Tower_unraid_bundle.pem \
  your-unraid:/boot/config/ssl/certs/Tower_unraid_bundle.pem

# 重新加载 nginx —— 不需要重启
ssh your-unraid "nginx -t && nginx -s reload"

注意：把 Tower 换成你的 Unraid 服务器名（Settings → Identification）。证书文件名必须是 {服务器名}_unraid_bundle.pem 格式。

验证

Bash

# 检查证书链
echo | openssl s_client -connect 192.168.1.100:443 \
  -CAfile "$(mkcert -CAROOT)/rootCA.pem" 2>&1 | grep "Verify return"
# 期望输出: Verify return code: 0 (ok)

然后完全重启 Chrome（Mac 上 Cmd+Q，不是关标签页），访问 Unraid 地址：

✅ 站点信息显示"证书有效"
✅ Network 标签里能看到 (disk cache)

对比

	自签名证书	mkcert 证书
Chrome 信任	❌ "不安全"	✅ "证书有效"
磁盘缓存	❌ 禁用	✅ 启用
页面刷新	全部重新下载	秒开（缓存命中）
Dashboard 体感	卡顿	丝滑

踩坑

Unraid 系统更新可能覆盖证书。 证书放在 USB 引导盘 /boot/config/ssl/certs/。大版本更新可能重新生成默认的自签名证书，重新部署一遍就行。mkcert CA 是单机的。 每台访问 Unraid 的设备都要单独跑 mkcert -install。CA 不会自动分发。多设备的话可以把根 CA 复制过去，但这有安全风险需要自己权衡。证书有效但仍显示"不安全"。 如果 Docker 容器图标是 HTTP 加载的，Chrome 会提示混合内容。证书本身没问题，磁盘缓存正常工作。可以在 DevTools → Security 标签确认。curl 默认不信任。 mkcert CA 在浏览器/系统信任存储里，不在 curl 的。CLI 验证加 --cacert "$(mkcert -CAROOT)/rootCA.pem"。

续期

mkcert 证书有效期大约 2 年 3 个月。到期了重新生成部署一遍就行，命令一样。

什么时候用别的方案

mkcert 只适合局域网访问。远程访问应该用正经的反向代理配 Let's Encrypt 或 Cloudflare 证书。Nginx Proxy Manager、Caddy 这类工具都能搞定，而且证书全网受信。

让 AI 帮你搞定

如果你用 AI 编程助手（OpenCode、Claude Code、Cursor 等），直接粘贴这段 prompt：

Markdown

帮我给 Unraid 服务器配置 mkcert SSL 证书，解决 Chrome 磁盘缓存被禁用的问题。
参考：https://mjshao.fun/blog/mkcert-unraid-ssl

我的环境：
- Unraid IP：[问我]
- 服务器名：[问我]
- SSH 连接方式：[问我]
- 其他 SAN（域名、Tailscale IP 等）：[问我]

执行步骤：
1. 检查并安装 mkcert（brew/apt/choco，根据我的系统）
2. 如果本地 CA 还没信任，执行 mkcert -install
3. 生成包含所有 SAN 的证书
4. 创建 PEM bundle，文件名格式 {服务器名}_unraid_bundle.pem
5. 备份 Unraid 上的原证书，scp 部署新证书
6. 在 Unraid 上 reload nginx，用 openssl s_client 验证
7. 提醒我完全重启 Chrome（Cmd+Q / 彻底退出）

Fix Chrome's Missing Disk Cache on Unraid with mkcert

用 mkcert 解决 Unraid 上 Chrome 不缓存的问题

The Hidden Performance Tax

The Fix: mkcert

Setup (One-Time)

Generate & Deploy

Verify

Before & After

Gotchas

Renewal

When to Use Something Else

Let AI Do It

隐藏的性能税

方案：mkcert

初始设置（一次性）

生成并部署

验证

对比

踩坑

续期

什么时候用别的方案

让 AI 帮你搞定

Recent posts