Ask HN: What's your solution for SSL on internal servers? • Hacker News Board

Re: Ask HN: What's your solution for SSL on internal servers?

#41

Post by saxonww » Wed, Feb 09, 2022, 2:08 PM UTC

viovanov wrote: post #20

bryanlarsen wrote: post #12

Earlier quoted context omitted.

SSL certificates contain the name, not the IP. So the IP address can be anything, including internal ones.

I thought Let's Encrypt wouldn't give you a cert if the domain on the cert resolves to a private IP. Good to know - thx.

They don't seem to check whether the hostname you're requesting a cert for resolves. At least with certbot, it requests the cert, creates the challenge record, then removes it after receiving the signed cert.

Re: Ask HN: What's your solution for SSL on internal servers?

#42

Post by PinguTS » Wed, Feb 09, 2022, 2:09 PM UTC

ThermalCube wrote: post #19

savolai wrote: post #7

Earlier quoted context omitted.

It appears to me the issue is browser warning dialogs that imply it is always very dangerous. There should be either more context explained in those dialogs or a recognition of/mode for sites that are supposed to be self signed.

(Untested idea) I'd suggest creating your own Root CA with an expire-date far in the future. Install it's public key as a trusted certificate and all derived certificates should not prompt any issues anymore

Then far in the future, when your own Root CA expires, then there comes all the trouble to update all the services/devices to trust the new Root CA.

This becomes a nightmare, when the original admin in the org is gone long times ago.

Re: Ask HN: What's your solution for SSL on internal servers?

#43

Post by amalter » Wed, Feb 09, 2022, 2:10 PM UTC

tyingq wrote: post #40

tmottabr wrote: post #32

Earlier quoted context omitted.

not if you use wildcard domain in the cert. LE already support wildcard certs

That's not really ideal either...one copy of the cert that isn't protected well becomes a master key of sorts for someone already inside your internal network.

Often inside your network you are more concerned with encryption than authentication. If you "just" need encryption over the wire, wildcard cert's are useful.

Re: Ask HN: What's your solution for SSL on internal servers?

#44

Post by phsm » Wed, Feb 09, 2022, 2:10 PM UTC

You can use https://github.com/joohoi/acme-dns to issue letsencrypt certificates to your internal hosts using DNS validation.

All it takes is to setup an ACME-DNS server somewhere (or just use author's public ACME-DNS server if you don't care much), and create one CNAME record in your DNS.

Re: Ask HN: What's your solution for SSL on internal servers?

#45

Post by itgoon » Wed, Feb 09, 2022, 2:11 PM UTC

Hashicorp Vault can generate certs via a web form or REST call. Easy to set up and maintain, and it's free.

Re: Ask HN: What's your solution for SSL on internal servers?

#46

Post by oulipo » Wed, Feb 09, 2022, 2:12 PM UTC

Can you explain your use-case for this?

Re: Ask HN: What's your solution for SSL on internal servers?

#47

Post by mikedelago » Wed, Feb 09, 2022, 2:12 PM UTC

At a previous job, I used Smallstep Certificates[0] as a hosted CA, though for certificates to communicate with our Kafka clusters. It worked pretty well, and was relatively easy to set up.

[0] https://smallstep.com/docs/step-ca

Re: Ask HN: What's your solution for SSL on internal servers?

#48

Post by res0nat0r » Wed, Feb 09, 2022, 2:15 PM UTC

I've not used this directly, but it may be useful: https://github.com/FiloSottile/mkcert

    mkcert is a simple tool for making locally-trusted development certificates. It requires no configuration.

    Using certificates from real certificate authorities (CAs) for development can be dangerous or impossible (for hosts like example.test, localhost or 127.0.0.1), but self-signed certificates cause trust errors. Managing your own CA is the best solution, but usually involves arcane commands, specialized knowledge and manual steps.

    mkcert automatically creates and installs a local CA in the system root store, and generates locally-trusted certificates. mkcert does not automatically configure servers to use the certificates, though, that's up to you.

Re: Ask HN: What's your solution for SSL on internal servers?

#49

Post by wyuenho » Wed, Feb 09, 2022, 2:16 PM UTC

Depends on how your home network is setup and how you deploy your services. If you have a public domain for you home IP, and it's the usual docker bridge network setup with only a couple of containers, using Traefik or Caddy as a reverse proxy will suffice. They'll automatically provision TLS certs for your services with very little to no effort at all. If it's something more complicated than that, such as needing a separate IP and mdns host name per container running on a vlan, or some multicloud kubernetes setup, you pretty much have to setup your own CA. In that case, look into mkcert and/or step-ca.

Re: Ask HN: What's your solution for SSL on internal servers?

#50

Post by daper » Wed, Feb 09, 2022, 2:16 PM UTC

If you have your own domain, then move it to one of the listed DNS providers and use DNS challenge with ACME:

We are using using certbot + cloudflare whis way. There is no HTTP request, certbot makes a temporary DNS record using the Cloudflare API to satisfy the challenge so you can run the script anywhere. Then copy the cert to the device that needs it.

DNS providers supported bycertbot:

https://community.letsencrypt.org/t/dns-providers-who-easily...