←back to thread

Getting ready to issue IP address certificates

(community.letsencrypt.org)
314 points Bogdanp | 4 comments | 25 Jun 25 16:21 UTC | HN request time: 0.657s | source
Show context
vkdelta ◴[25 Jun 25 19:03 UTC] No.44380805[source]▶
Does it help getting encrypted https (without self signed cert error) on my local router ? 192.168.0.1 being an example login page.
replies(6): >>44380853 #>>44380871 #>>44380923 #>>44381115 #>>44381757 #>>44382265 #
dark-star ◴[25 Jun 25 22:10 UTC] No.44382265[source]▶
no but you can do something closely related:

- get a domain name (foo.com) and get certificates for *.foo.com

- run a DNS resolver that maps a.b.c.d.foo.com (or a-b-c-d.foo.com) to the corresponding private IP a.b.c.d

- install the foo.com certificate on that private IP's device

then you can connect to devices in your local network via IP by using https ://192-18-1-1.foo.com

Since you need to install the certificate in step 3 above, this works better with long-lived certificates, of course, but aotomation helps there

replies(2): >>44382457 #>>44383727 #
1. michaelt ◴[25 Jun 25 22:43 UTC] No.44382457[source]▶
I considered doing that for a project once.

Then I realised that when my internet was down, 192-18-1-1.foo.com wouldn't resolve. And when my internet is down is exactly when I want to access my router's admin page.

I decided simply using unencrypted HTTP is a much better choice.

replies(1): >>44382624 #
2. yjftsjthsd-h ◴[25 Jun 25 23:05 UTC] No.44382624[source]▶
> Then I realised that when my internet was down, 192-18-1-1.foo.com wouldn't resolve.

Just add a local DNS entry on your local DNS server (likely your router).

replies(2): >>44382837 #>>44385344 #
3. michaelt ◴[25 Jun 25 23:41 UTC] No.44382837[source]▶
I could start running my own DNS server, and start manually curating all the important entries in it, sure.

Or I could just use HTTP, or a self-signed certificate. If an attacker intercepts traffic on twenty feet of ethernet cable in my home's walls, I've probably got bigger problems than protecting my router admin password.

4. jeroenhd ◴[26 Jun 25 08:23 UTC] No.44385344[source]▶
You don't even need to, mDNS has been enabled by default by most devices for ages now. You'll have to look up what the name is your manufacturer chose (if you use Windows, you van usually hit the network explorer tab and it'll be right in there, don't know about other OSes). It'll even work if IPv4 is broken (if you ran out of DHCP leases or whatever) because it almost always natively runs on IPv6 too.