4 ms·
IP addresses must be accessible from the internet, so still no way to support TLS for LAN devices without manual setup or angering security researchers.
by xg15 10mo ago
IP addresses must be accessible from the internet, so still no way to support TLS for LAN devices without manual setup or angering security researchers.
- progbits 10mo agoI mean if it's not routable how do you want to prove ownership in a way nobody else can? Just make a domain name.
- alibarber 10mo agoAlso I don't see the point of what TLS is supposed to solve here? If you and I (and everyone else) can legitimately get a certificate for 10.0.0.1, then what are you proving exactly over using a self-signed cert? There would be no way of determining that I can connecting to my-organisation's 10.0.0.1 and not bad-org's 10.0.0.1.
- londons_explore 10mo agoPerhaps by providing some identifier in the URL? ie. https://10.0.0.1(af81afa8394fd7aa)/index.htm https://10.0.0.1(af81afa8394fd7aa)/index.htm The identifier would be generated by the certificate authority upon your first request for a certificate, and every time you renew you get to keep the same one.
- alibarber 10mo agoI see what you're getting at - but to me this sounds almost exactly like just using DNS, even if the (A/AAAA) record you want to use resolves to an un-routable address: https://letsencrypt.org/docs/challenge-types/#dns-01-challenge https://letsencrypt.org/docs/challenge-types/#dns-01-challen... - you just create a DNS TXT record instead of them trying to access a server at the address for verification.
- cpach 10mo agoA public CA won’t give you a cert for 10.0.0.1
- alibarber 10mo agoExactly - no one can prove they own it (on purpose because it's reserved for private network use, so no one can own it)
- Latty 10mo agoThis is assuming NAT, with IPv6 you should be able to have globally unique IPs. (Not unique to IPv6 in theory, of course, but in practice almost no one these days is giving LAN devices public IPv4s).
- arianvanp 10mo agoFor ipv6 proof of ownership can easily be done with an outbound connection instead. And would work great for provisioning certs for internal only services.
- deleted 10mo ago[deleted]
- cpach 10mo agoOne can also use a private CA for that scenario.
- bigfishrunning 10mo agoExactly -- how many 192.168.0.1 certs do you think LetsEncrypt wants to issue?
- tialaramex 10mo agoThe BRs specifically forbid issuing such a certificate since 2015. So, slightly before they were required to stop using SHA-1, slight after they were forbidden from issuing certificates for nonsense like .com or .ac.uk which obviously shouldn't be available to anybody even if they do insist they somehow "own" these names.
- tialaramex 10mo agoI can't edit it now, but that comment should have said *.com or *.ac.uk -- that is wildcards in which the suffix beyond the wildcard is an entire TLD or an entire "Public Suffix" which the rules say don't belong to anyone as a whole, they're to be shared by unrelated parties and so such a wildcard will never be a reasonable thing to exist.
- johannes1234321 10mo agoI recently migrated to a wildcard (*.home.example.com) certificate for all my home network. Works okay for many parts. However requires a public DNS server where TXT records can be set via API (lego supports a few DNS providers out of the box, see https://go-acme.github.io/lego/dns/ https://go-acme.github.io/lego/dns/ )
- mnahkies 10mo agoI use a fairly niche provider (https://go-acme.github.io/lego/dns/zonomi/index.html https://go-acme.github.io/lego/dns/zonomi/index.html) and it's supported - I'd go further and say they support most providers
- stackghost 10mo ago>so still no way to support TLS for LAN devices without manual setup or angering security researchers. Arguably setting up letsencrypt is "manual setup". What you can do is run a split-horizon DNS setup inside your LAN on an internet-routable tld, and then run a CA for internal devices. That gives all your internal hosts their own hostname.sub.domain.tld name with HTTPS. Frankly: it's not that much more work, and it's easier than remembering IP addresses anyway.
- cpach 10mo agoThere’s also the DNS-01 challenge that works well for devices on private networks.
- tosti 10mo ago> run a CA > easier than remembering IP addresses idk, the 192.168.0 part has been around since forever. The rest is just a matter of .12 for my laptop, .13 for the one behind the telly, .14 for the pi, etc. Every time I try to "run a CA", I start splitting hairs.
- stackghost 10mo agoNo, what I'm saying is 1. Running a CA is more work than just setting up certbot for IP addresses, but not that much more And that enables you to 2. Remember only domain names, which is easier than ip addresses. I guess if you're ipv4 only and small it's not much benefit but if you have a big or bridged network like wonderLAN or the promised LAN it's much better.
- sgjohnson 10mo agoIPv6? You wouldn’t even need to expose the actual endpoints out on the open internet. DNAT on the edge and point inbound traffic on a VM responsible for cert renewals, then distribute to the LAN devices actually using those addresses.
- arisudesu 10mo agoWhat do you mean by 'LAN', everything should be routable globally with IPv6 decade ago anyway /s
- oddly 10mo agoI recently found this, might help someone here. Genius solution. https://sslip.io/ https://sslip.io/
- patmorgan23 10mo agoIf you have non-public IPs you need certs for you should set up a non-public certificate authority and issue your own certs for them.