3 ms·

https://github.com/acmesh-official/acme.sh https://github.com/acmesh-official/acme.sh this works for me for most of my devices at home. pfSense and Proxmox both

https://github.com/acmesh-official/acme.sh https://github.com/acmesh-official/acme.sh this works for me for most of my devices at home. pfSense and Proxmox both have plugins for it. Each device requests its own certificate for a host on a private subdomain of a domain I own e.g. hostname.private.domain.com

mrweasel 6y ago
That still only works if your device is able to reach the internet. We have a bunch of servers which aren't directly on the internet, because they don't need to.
- carlhjerpe 6y ago
  You can run acme.sh on another device using dns-01 authentication. Then you can move the certificates to your servers in some way. This would mean one machine having access to the internet and the private servers though.
  - dastx 6y ago
    But also, LE certs expire after 90 days, meaning this manual process needs to be repeated every <90 days. Though, I'd be curious to know what the threat model for such a service is. Why is it not allowed to connect to the Internet? Can a different internal machine connect to it? And if so, is that machine allowed to connect to the Internet. What happens if someone connected to that machine and opens a tunnel through their machine to the Internet (if at all possible). Understanding the threat model will give you a solution on how best to use dns-01 challenge to generate certs and keep them updated.
    - castillar76 6y ago
      Alternately, you could use a fast CA solution like Netflix' lemur or step-ca or even just openssl, make your own CA, and distribute it to everything. If your threat model is such that that stuff should never connect to the outside world, why risk it by repeatedly moving things in from outside? Just generate a closed CA for your closed environment, trust it once, and move on.