4 ms·
I enjoy Tailscale, but their split-DNS approach for letsencrypt is a huge turn off. There's no need for my network topology to be exposed via certificate transp
by xyzzy_plugh 5y ago
I enjoy Tailscale, but their split-DNS approach for letsencrypt is a huge turn off. There's no need for my network topology to be exposed via certificate transparency logs.
- lilyball 5y agoWhat's the alternative?
- madjam002 5y agoPrivate PKI with Root CA
- egberts1 5y agoI made a little bash-only ditty on managing private CA https://github.com/egberts/tls-ca-manage https://github.com/egberts/tls-ca-manage
- easton 5y agoThe Caddy web server has a built in ACME compliant CA. Works well for a private CA, and it’s a couple lines in the config file.
- lilyball 5y agoThat requires modifying your OS trust store[1], doesn’t it? [1] And browser trust store if it doesn’t use the OS, and OpenSSL trust store if you use tools that don’t use the OS trust store, etc
- zokier 5y agoWhat do you see as the alternative? And isn't all this opt-in, you can run your own dns and do let's encrypt yourself if you prefer?