←back to thread

Getting ready to issue IP address certificates

(community.letsencrypt.org)
314 points Bogdanp | 1 comments | 25 Jun 25 16:21 UTC | HN request time: 0.212s | source
Show context
vkdelta ◴[25 Jun 25 19:03 UTC] No.44380805[source]▶
Does it help getting encrypted https (without self signed cert error) on my local router ? 192.168.0.1 being an example login page.
replies(6): >>44380853 #>>44380871 #>>44380923 #>>44381115 #>>44381757 #>>44382265 #
qmarchi ◴[25 Jun 25 19:10 UTC] No.44380871[source]▶
No but maybe yes: It would be impossible, and undesirable to issue certificates for local addresses. There's no way to verify local addresses because, inherently, they're local and not globally routable.

However, if a router manufacturer was so inclined, they _could_ have the device request a certificate for their public IPv4 address, given that it's not behind CG-NAT. v6 should be relatively easy since (unless you're at a cursed ISP) all v6 is generally globally routable.

replies(1): >>44385321 #
1. jeroenhd ◴[26 Jun 25 08:20 UTC] No.44385321[source]▶
Even behind CGNAT, you could probably get away with DNS here. If you provide your customers with customeraccount.manufacturerrouters.com, you can then use DNS validation to get a valid certificate for *.customeraccount.manufacturerrouters.com. Put a record in there that points to the local router IP (I.E. settings.customeraccount.manufacturerrouters.com) and you can get HTTPS logins on your local network, even with local IP addresses if the CAB still allows that.

It's not exactly user friendly, but it'll work.

Personally, I have a private CA that I use. My home router has a domain name pointing towards it and has been loaded up with my private certificate. I get the certificate error once a year when the thing expires but in the mean time I can access my router securely.