> all you have to do is find the root CA it generates and install it on your devices. Unfortunately that's the hard part - getting Firefox/chrome/edge/safari a

> all you have to do is find the root CA it generates and install it on your devices. Unfortunately that's the hard part - getting Firefox/chrome/edge/safari and is/libc/curl to all trust the ca. It's a little easier on Linux, but still convoluted. And with an actual trusted CA the trust is way too wide (every domain). Not to mention revocation lists and certificate renewals (and revocation s) ... Dedicated letsencrypt "internal" domain is probably the sweetspot for most uses these days. Maybe a serviceN.int.example.com where int.example.com allows for dynamic DNS updates/DNS challenges. I've been thinking about setting up powerdns/coredns/knotdns with rfc dynamic updates for a dedicated internal domain - but for now tailscale with magic DNS mostly fills the need (unfortunately not with ssl for all k8s internal services, "only" VPN).