4 ms·

Can’t you just use a Let’s Encrypt cert? The domain needs to be publicly resolvable, but it doesn’t have to resolve to the same IP returned by your internal DNS

by sjy 6y ago

Can’t you just use a Let’s Encrypt cert? The domain needs to be publicly resolvable, but it doesn’t have to resolve to the same IP returned by your internal DNS, and you can use wildcard certificates if you don’t want your internal subdomains to be publicly resolvable at all.

est 6y ago
> The domain needs to be publicly resolvable The company TLD was purposely built to hide behind the LAN. Been publicly resolvable is a huge a security risk. Public recursive resolvers will log where and when a user visits an internal site.
- gsich 6y ago
  Not if you use an internal resolver.
- hedora 6y ago
  Why not have the public resolver resolve everything to a “Your DNS is misconfigured; contact IT” static page?
kortilla 6y ago
Now your internal infrastructure depends on let’s encrypt as well as an external DNS registrar.