3 ms·
To be more exact, it's far easier to just shell out the cash for a domain name (or get a free subdomain from somewhere) and then just map the DNS on that domain
by noirscape 3y ago
To be more exact, it's far easier to just shell out the cash for a domain name (or get a free subdomain from somewhere) and then just map the DNS on that domain to your internal infrastructure. That way you can just use letsencrypt certs without any hassle.
If you don't want to expose network details, use something like Tailscale to get unique internal IPs and map those. (Don't use Tailscale's own MagicDNS, that one logs individual certificates for machines into CT rather than giving you a wildcard cert for your tailnet).
- globular-toast 3y agoThen you'll need a server running locally and the firewall rules to expose that to the internet and either a static IP address or some dynamic DNS client running. No, I think it's far easier to just not do it.
- guipsp 3y agoNo, not really. You can obtain the certificate externally and use it internally. The DNS challenge type does not require a web server exposed externally either. Sure, it's far easier not to do it. It's also far easier to have no root password.
- noirscape 3y agoYou don't; DNS-01 doesn't require contacting any servers besides the DNS registrar, which is what makes it so nice. In practice, most domain registrars have certbot plugins - you just grab your API key from their customer portal and put it in a file, then run certbot in DNS-01 mode and instruct them to use that. Certbot places a temporary TXT record, which gets verified and the certificate is issued. Then certbot removes the TXT record and that's that. If there's no plugin, you do that by hand, which works but is a bit more involved. You don't need a firewall for that or a DDNS client. Also if you have a weird registrar that only offers you to set NS records, most VPS providers have free DNS services.