3 ms·
I would love to use LE but I can't because my use case is all about internal network. I don't want self-signed cert. I want to leverage internal domain system,
by yeukhon 11y ago
I would love to use LE but I can't because my use case is all about internal network. I don't want self-signed cert. I want to leverage internal domain system, especially the ones with IPs. While I understand the design of LE would not encourage any of the above, I do hope one day LE has a solution to end the pain of self-signed cert (without modifying host CA file).
- pfg 11y agoIf your internal domain is also a public (ICANN) domain, you can use DNS-based validation to get a certificate. Basically, you create a TXT record with a challenge token and make sure Let's Encrypt can resolve that record. Your actual internal domains don't have to be publicly resolvable or routable for that to work. This is still a WIP in the official client, but there are a number of other clients with dns-01 support[1]. Publicly trusted CAs are not allowed to issue certificates for internal domains (i.e. made-up names which don't end with an ICANN TLD.) [1]: https://github.com/letsencrypt/letsencrypt/wiki/Links#bash https://github.com/letsencrypt/letsencrypt/wiki/Links#bash
- newjersey 11y agoHow does turret19.local talk to commandserver.local? I imagine there has to be someone on the middle who says yes 192.168.1.24 is actually the command server and not camera3.local or public webserver.local How is it supposed to work? How can LE know that you are 192.168.1.24? Maybe we'd need some kind of certificates that are only valid within a certain zone? How would that work? Thanks.
- e12e 11y agoYou could use their code/system, if you set up something like: https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder internally?