3 ms·
It's certainly possible to get a trusted certificate for a LAN-only device. DNS-based validation is your best option here. The only requirement is that you use
by pfg 10y ago
It's certainly possible to get a trusted certificate for a LAN-only device. DNS-based validation is your best option here. The only requirement is that you use an ICANN ("public") domain. This is not a requirement made up by Let's Encrypt, but rather by the CA/B Forum and applies to all CAs (for good reasons[1]!)
The Plex approach would be possible with Let's Encrypt, though you would have to find a way to avoid running into rate limits (via PSL or by making users use their own domains, which is admittedly only an argument if you're catering to a technical audience).
[1]: https://cabforum.org/wp-content/uploads/Guidance-Deprecated-Internal-Names.pdf https://cabforum.org/wp-content/uploads/Guidance-Deprecated-...
- theandrewbailey 10y agoAn important point is that you need to own that public (sub)domain, even if it is only for use on a private LAN.
- pfg 10y agoNot necessarily. As an example, an IoT vendor could set up a domain for their devices and delegate a subdomain to each device (basically what Plex does). They could also provide an API that allows those devices to provision a TXT record to solve the domain validation challenge. The actual ACME client would still run on the device itself, and validate using that API. You'd need a way to get past the rate limits (either via PSL or with a rate limit exception), but other than that this is doable.