5 ms·

One of the wonderful aspects of this, that no-ones pointed out yet, is that these can used for INTERNAL domains, without you having to run your own internal CA.

One of the wonderful aspects of this, that no-ones pointed out yet, is that these can used for INTERNAL domains, without you having to run your own internal CA. i.e. lets say your internal network DNS domain is 'my-company-lan.com' - all you have to do is ensure that 'my-company-lan.com' is also registered in public DNS[1], and then you can secure ALL your internal services using a free LE wildcard cert, that's automatically trusted by all platforms and browsers[2]. For some companies that's going to be a BIG cost and resources saving. -- [1] but not actually used for any public facing services. [2] Mostly...

Jaruzel 9y ago
Going to reply to my own comment here. It's at this point that I swear profusely at Microsoft yet again, for pushing the concept of '.local' domain suffixes a decade ago. As it's not a legal TLD, I can't get certs for any of my internal services without rolling my own internal CA, which only works automatically for Windows domain machines, and not for anything else.
- EvanAnderson 9y ago
  The ".local" suffix was a terrible idea, to be sure. Active Directory domain rename in small environments is relatively painless.
  - Jaruzel 9y ago
    Unless of course, you are running Exchange. In which case it's not supported :(
    - EvanAnderson 9y ago
      Unfortunately, yes. I've been lucky enough to be able to get domain renames done in Exchange 2003 environments (which is supported) or in non-Exchange environments. Migrating to a new domain because of a poorly-chosen name is a real pain. (I have one Customer who has a "." in their NetBIOS domain name. That creates some interesting kinds of hell-- completely breaks the NPS RADIUS server in Windows 2012.)
- fanf2 9y ago
  I agree that it’s terrible, but the reason they used to recommend .local goes back to their Small Businness Server in the 1990s when it was very expensive and bureaucratic to register a domain - not something they could demand of their target market. MS’s error was their failure to update their recommendations after domain registration became cheap and easy.
  - yellowapple 9y ago
    IIRC Microsoft does now recommend using a real domain with a real TLD nowadays.
- amaccuish 9y ago
  And also conflicts with mdns. :(
- telcal 9y ago
  Can you create a CNAME on your internal DNS so server1.company.local = server1.company.com? Found here: https://community.spiceworks.com/how_to/139715-letsencrypt-win-simple-for-iis-windows-web-server-when-manual-mode-is-needed https://community.spiceworks.com/how_to/139715-letsencrypt-w...
fulafel 9y ago
You could do this before too, without wildcards.
- 16bytes 9y ago
  Can you outline the approach how this would work? It was my understanding that in order to use Let's Encrypt you needed a public facing server to verify ownership.
  - CaveTech 9y ago
    You just need public facing DNS.
  - Jaruzel 9y ago
    For the standard LE certs, you need a public facing web server for the domain name in question, and LE give you a keyfile to put into: '/.well-known/pki-validation' For the wildcard certs, you just need to add a TXT record to the public DNS entry, no public web server required. Even if you have no intention of using your internal DNS domain name on the internet, it's good practice to register it anyway.
    - Karunamon 9y ago
      Is there a "standard" TLD for internal use that will also fit this requirement? The problem here is that there's no such thing as domain ownership, only domain renting. You forget to pay your bill (read: someone loses an email) and a core part of your infrastructure is up in smoke, or worse, taken over by a squatter.
      - tialaramex 9y ago
        It makes no sense to have publicly trusted certificates for names that have no defined legitimate meaning - what is being certified? Nothing. Accordingly no public CA is permitted to issue such certs.
      - slrz 9y ago
Shoothe 9y ago
Just remember that the cert will be logged (Certificate Transparency) so any names there will be disclosed to the public. Wildcards help a little here though.

Jaruzel 9y ago

Going to reply to my own comment here. It's at this point that I swear profusely at Microsoft yet again, for pushing the concept of '.local' domain suffixes a decade ago. As it's not a legal TLD, I can't get certs for any of my internal services without rolling my own internal CA, which only works automatically for Windows domain machines, and not for anything else.

EvanAnderson 9y ago
The ".local" suffix was a terrible idea, to be sure. Active Directory domain rename in small environments is relatively painless.
- Jaruzel 9y ago
  Unless of course, you are running Exchange. In which case it's not supported :(
  - EvanAnderson 9y ago
    Unfortunately, yes. I've been lucky enough to be able to get domain renames done in Exchange 2003 environments (which is supported) or in non-Exchange environments. Migrating to a new domain because of a poorly-chosen name is a real pain. (I have one Customer who has a "." in their NetBIOS domain name. That creates some interesting kinds of hell-- completely breaks the NPS RADIUS server in Windows 2012.)
fanf2 9y ago
I agree that it’s terrible, but the reason they used to recommend .local goes back to their Small Businness Server in the 1990s when it was very expensive and bureaucratic to register a domain - not something they could demand of their target market. MS’s error was their failure to update their recommendations after domain registration became cheap and easy.
- yellowapple 9y ago
  IIRC Microsoft does now recommend using a real domain with a real TLD nowadays.
amaccuish 9y ago
And also conflicts with mdns. :(
telcal 9y ago
Can you create a CNAME on your internal DNS so server1.company.local = server1.company.com? Found here: https://community.spiceworks.com/how_to/139715-letsencrypt-win-simple-for-iis-windows-web-server-when-manual-mode-is-needed https://community.spiceworks.com/how_to/139715-letsencrypt-w...

fulafel 9y ago

You could do this before too, without wildcards.

16bytes 9y ago
Can you outline the approach how this would work? It was my understanding that in order to use Let's Encrypt you needed a public facing server to verify ownership.
- CaveTech 9y ago
  You just need public facing DNS.
- Jaruzel 9y ago
  For the standard LE certs, you need a public facing web server for the domain name in question, and LE give you a keyfile to put into: '/.well-known/pki-validation' For the wildcard certs, you just need to add a TXT record to the public DNS entry, no public web server required. Even if you have no intention of using your internal DNS domain name on the internet, it's good practice to register it anyway.
  - Karunamon 9y ago
    Is there a "standard" TLD for internal use that will also fit this requirement? The problem here is that there's no such thing as domain ownership, only domain renting. You forget to pay your bill (read: someone loses an email) and a core part of your infrastructure is up in smoke, or worse, taken over by a squatter.
    - tialaramex 9y ago
      It makes no sense to have publicly trusted certificates for names that have no defined legitimate meaning - what is being certified? Nothing. Accordingly no public CA is permitted to issue such certs.
    - slrz 9y ago

Shoothe 9y ago

Just remember that the cert will be logged (Certificate Transparency) so any names there will be disclosed to the public. Wildcards help a little here though.