←back to thread

Just want simple TLS for your .internal network?

(github.com)
246 points nh2 | 2 comments | 18 Oct 24 06:10 UTC | HN request time: 0s | source
Show context
ndsipa_pomu ◴[22 Oct 24 08:36 UTC] No.41912342[source]▶
I prefer to assign an external name to an internal device and grab a free SSL cert from LetsEncrypt, but using DNS challenge instead as internal IP addresses aren't reachable by their servers.
replies(9): >>41912368 #>>41912827 #>>41913126 #>>41913387 #>>41913720 #>>41913826 #>>41916306 #>>41917079 #>>41917804 #
DandyDev ◴[22 Oct 24 08:42 UTC] No.41912368[source]▶
I do this as well, but be aware that these external names you're using for internal devices become a matter of public record this way. If that's okay for you (it is for me), then this is a good solution. The advantage is also that you run no risk of name clashes because you actually own the domain
replies(7): >>41912424 #>>41912505 #>>41912544 #>>41912570 #>>41912671 #>>41912732 #>>41919325 #
xfer ◴[22 Oct 24 08:53 UTC] No.41912424[source]▶
Or use a wildcard cert for all internal certs.
replies(3): >>41912563 #>>41912669 #>>41912935 #
1. pridkett ◴[22 Oct 24 10:30 UTC] No.41912935[source]▶
This is exactly what I do. After seeing how much of my internal network was exposed in certificate transparency logs, I noped out and just do a DNS challenge for a wildcard for almost everything.

Now it’s have a nice script that distributes my key automatically to 20 or so hosts and apps and have a real SSL cert on everything from my UDM Pro to my Synology to random Raspberry Pis running containers. Most of which have domain names that only resolve on my local network.

This is made possible by a fairly robust DNS setup that consists of not only giving A records to all my hosts automatically, but also adding in CNAMEs for services and blocking almost all outbound DNS, DNS over TLS, DoH, etc.

replies(1): >>41914833 #
2. dopp0 ◴[22 Oct 24 14:45 UTC] No.41914833[source]▶
> fairly robust DNS setup that consists of not only giving A records to all my hosts

looks nice, can you give more details on this? tks!