3 ms·
I've been using a slightly different approach which skips the mkcert step. I really need to write a blog post, but roughly: - register a subdomain on getlocalc
by 8organicbits 3y ago
I've been using a slightly different approach which skips the mkcert step. I really need to write a blog post, but roughly:
- register a subdomain on getlocalcert.net
- save credentials
- create LetsEncrypt certificate with cert-manager
Since LetsEncrypt is a trusted CA, there is no need for mkcert.
https://github.com/robalexdev/getlocalcert-client-tests/tree/main/examples%2Fcert-manager https://github.com/robalexdev/getlocalcert-client-tests/tree...
- mschuster91 3y agoThe problem with LetsEncrypt is that now your entire internal infrastructure is visible on CT logs, which gives an attacker an easy index to enumerate and scan infrastructure once they have access to your internal systems somehow.
- szszrk 3y agoYou can address that quite well with wildcard certificates. Not ideal, but more than enough for a decent homelab and likely a well thought through test environment.
- skarlso 3y agoWell, aside from the fact that it's calling out to the internet, the service is in early access. Using cert-manager at and a self-signed cert, you can set this up in a fenced environment as well.