3 ms·
Well Let's Encrypt has a solution, it is DNS authentication, which doesn't require Let's Encrypt to establish a direct connection to the device. But you still n
by cm2187 6y ago
Well Let's Encrypt has a solution, it is DNS authentication, which doesn't require Let's Encrypt to establish a direct connection to the device. But you still need a way to automatically renew the certificate (your DNS must have a supported API) and deploy it automatically. But that's not a Let's Encrypt problem to solve.
- jackweirdy 6y agoI use this solution myself. I have a domain name I own and only have A records configured for use on internal DNS. Externally it is managed by cloudflare, and certbot uses the cloudflare plugin to renew certificates before deploying certs to my hardware over telnet
- dingaling 6y ago> But that's not a Let's Encrypt problem to solve. But it's a problem they permitted to arise by enforcing 90-day expiry An internal web config interface could happily use a 10-year cert
- cm2187 6y agoBrowsers are also enforcing this, so again not really a let’s encrypt problem. But create your own root certs. That’s a much better route if you want to never update your certs on the device.
- iso947 6y agoDo browsers allow > 13 month validity for certs from private CAs? Either way I’d rather not trust my own CA as I’m not capable of keeping such a powerful tool secure.
- cm2187 6y agoFor private CAs you can do whatever you want. It is only for public CAs that browser enforce short certificate expiries.