Maybe this is more of a home lab question, but I’m utterly clueless regarding PKI and HTTPS certs, despite taking more than one class that goes into some detail about how the system works. I’ve tried finding guides on how to set up your own CA, but my eyes glaze over after the third or fourth certificate you have to generate.
Anyway, I know you need a public DNS record for HTTPS to work, and it struck me recently that I do in fact own a domain name that I currently use as my DNS suffix on my LAN. Is there a way I can get Let’s Encrypt to dole out a wildcard certificate I can use on the hosts in my LAN so I don’t have to fiddle with every machine that uses every service I’m hosting? If so, is there a guide for the brain dead one could point me to? Maybe doing this will help me grock the whole PKI thing.
UPDATE:
Here’s what I ended up doing:
- set up cloudflare as the DNS provider for my domain
- use certbot plus the cloudflare DNS plugin to create a wildcard cert. Because I want to use wildcard certs and because the web servers are on a NATed private LAN, HTTP-01 challenge cannot be used. Wildcard certs use a DNS challenge. From what I understand of the certbot docs, the HTTP challenge makes a certain HTTP resource available on the web server, then requests that resource, presumably via an external client, to verify that you own the domain. the DNS challenge works by temporarily placing a TXT record in your DNS server. This method requires your DNS provider to have an accessible API that allows the modification of resource records.
- Once the cert and key are generated, I place them on the servers I want to to make use of them and set up the web server accordingly.
- Visit the websites and confirm that HTTPS works.
There are some other hiccups that I’m guessing aren’t related to HTTPS. Per My earlier question about self hosting, I’m experimenting with NodeBB. I cannot get the two test instances to federate, which I initially assumed was an issue with HTTPS. That’s a question best asked elsewhere, though I thought it relevant to note because it was my initial purpose for setting up HTTPS.
I’ll mention this as no one has yet but you can be your own CA. Tools like mkcert make it easy
https://github.com/FiloSottile/mkcert
This is potentially more hassle (than using public DNS) as you have to get your CA certs onto every device. However it may be suitable depending on the situation.
Running your own CA is essentially still a form of self signed. Though it will work better for some use cases (at the cost of more complexity)
I know what you mean but using real self-signed certificates (i.e. no CA at all) with modern browsers causes so many issues I find them unusable.
browsers complain less, and some apps (like HomeAssistant Android) only accept that
Trust the self signed cert. Works similarly to trusting a CA.
for every single subdomain, on desktop. firefox mobile does not even remember the decision. HA Android straight out refuses it, and thats not a local problem but a relatively known one in the community
Just create a wildcard domain certificate !
I access all my services in my lan through
https://servicename.home.lab/I just had to add the rootCA certificat (actually the intermediate certificate) into my trust store on every device. That’s what they actually do, just in automated way !Never had an issue to access my services with my self-signed certs, neither on Android, iOS, windows, linux ! Everything served from my server via my reverse proxy of choice (Treafik).
However I do remember that there was something of importance to make my Android device accept the certificate (something in certificate itself and the extension).
If you’re interested I can send you the snipped of a book to fully host your own CA :). It’s a great read and easy to follow !
Import it into the trust store in the browser/OS. It should be the same (or very similar) operation for a self-signed cert and a CA that isn’t subordinate to the standard internet root CAs.
If you can’t import your own root CA cert then you’re probably screwed on both fronts and are going to have to use certs issued by a public CA that’s subordinate to a commonly trusted root CA.
My point here is that there’s little distinguishing a self-signed cert and a cert issued by your own private CA for most people that are self-hosting.
With certbot there’s probably a plugin to do it automatically, but if you just want to get something working right now you can run the following to manually run a dns challenge against your chosen domain names and get a cert for any specified. This will expire in ~3 months and you’ll need to do it again, so I’d recommend throwing it in a cron job and finding the applicable
certbot-dns-dnsproviderplugin that will make it run without your input. Once you have it working you can extract the certs from/etc/letsencrypt/liveon most systems. Just be aware that the files there are going to be symlinks so you’ll want to copy them before tarballing them to move other machines.certbot --preferred-challenges dns --manual certonly -d *.mydomain.tld -d mydomain.tld -d *.local.mydomain.tldThe most straightforward thing to do, on a private LAN, is to make all your own certs, from a custom root cert, and then manually install that cert as “trusted” on each machine. If none of the machines on this network need to accessed from outside the LAN, then you’re golden.
I’ve never done it myself but this may be what you’re looking for.
Reverse proxy + DNS-challenge wildcard cert for your domain. The end. Super easy to set up and zero maintenance. Adding a new service is just a couple clicks in your reverse proxy and you’re done.
I’m not sure about wildcard certs but I use this container to dole out letsencrypt certs for web services and it’s fairly straightforward compared to traefik or something: https://github.com/lucaslorentz/caddy-docker-proxy
Caddy docs: https://caddyserver.com/docs/quick-starts/reverse-proxy
You don’t need a public DNS record for https to work. You can just use public external certs as long as it’s for a domain you own. You don’t need to setup the same domains externally.
If you want certs for a domain you own, then yeah you’re looking at self signed.
LetsEncrypt.
I did follow this guide from Techno Tim, he uses cloudflare but you can go with Lets encrypt aswell
I use Nginx and let’s encrypt. Works super easily and auto updates.
If you own a domain, which you do, you can get wildcard certs from Let’s Encrypt using a DNS challenge. Most (all?) popular reverse proxies can do this either natively or via an addon/module, you just need to use a supported DNS provider.
You don’t need public DNS. You can use whatever domain you want if you use your own DNS server (though you should use one you own, or something under the .internal TLD).
Likewise, you can issue whatever certs you want if you trust the CA.
But LE does support wildcard certs. You can get them with certbot or other tools.
Personally I use traefik, which has LE support built in. It automatically gets an individual cert for each service. If you use caddy, I’m sure it has something similar.
I have a script to self-sign 10 year certs on internal traffic only, and then added my public cert to devices needing it. I’m going to be really annoyed in a decade, but until then I’m having a ball 🙂
Some form of domain and a DNS server (router or Pi-Hole) in your LAN
If you have your own domain and your DNS provider has an API, you can get a certificate for anything in your domain
