3 ms·
> In fact, the only way workaround for this for a lan-only device that is not internet accessible but still wants security on the intranet is to obtain a certif
by lol768 9y ago
> In fact, the only way workaround for this for a lan-only device that is not internet accessible but still wants security on the intranet is to obtain a certificate for some website https://example.com/ https://example.com/ and, after obtaining said certificate, modify its DNS settings so that it points to an internal IP (where a copy of the certificate is installed)
No need to change DNS A/AAAA records, have it point to an internal IP from day one and use ACME's DNS challenge to get the cert. I'll readily admit this doesn't solve the underlying problem though, and you'd presumably end up re-using the same cert on all IoT devices too which isn't ideal (a unique self-signed cert would be much better here!)
- DKnoll 9y agoI would just go with an internal/corporate CA which solves this problem elegantly. It's a widely used solution. You don't even need to power on the CA (ideally a VM) unless you're generating certs.
- xg15 9y agoAlso note that this will require internet access for no other reason than performing that DNS request - even if all the actual communication with the device were local.