Every homelab operator knows the problem: you access a self-hosted service via its IP address and a port in your browser, and are immediately greeted by a red SSL warning ("This connection is not secure"). Ignoring these warnings is not only annoying but also a bad habit in the long run. In this article, I'll show you how to create real, green SSL certificates for your local services using Nginx Proxy Manager (NPM) and the Let's Encrypt DNS-Challenge – completely without having to expose any ports to the internet!