Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt • Hacker News Board

Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt

#91

Post by Schwan » Fri, Sep 04, 2020, 1:01 PM UTC

darkarmani wrote: post #74

Schwan wrote: post #21

Its TLS and not SSL. Its TLS for a long time now... And yes be aware that through this, it works fine but you are also exposing your internal infrastructure details through dns. I'm not seeing a big issue, just be aware of it.

Good point even if it is pedantic. I shift between terms depending on my audience, but try to use TLS in technical circles as an example. I worry that I'll forever have to use both terms, because while SSL is the term that communicates better to semi-literate audiences, I worry that some security expert will assume I don't know anything because I'm using the "wrong" term.

Jepp i actually assumed that at one point and i was right :D

Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt

#92

Post by throw0101a » Fri, Sep 04, 2020, 1:37 PM UTC

e12e wrote: post #81

throw0101a wrote: post #75

Earlier quoted context omitted.

The way it works for us: First we use standard LE/ACME clients: either certbot or dehydrated. They ask for something like svc1.int.example.com ($DOMAIN). In the hook script(s)† we manipulate the $DOMAIN string to put it into dnsauth.example.com ($AUTH_ZONE) sub-domain and send that new string to the DNS server that handles the dnsauth zone (and only that). Before all of this we would have set up, in our public-extern…

Ok, thank you for the details and managing expectations. This still seems to warrant some experimentation. In my case I'm mostly interested in delegating a domain/sub-domain somewhere I can easily update (be that run my own dns, host it somewhere with an api) - while having my main domains on a more boring/static dns infrastructure - yet still easily get certs for things like imap.example.com - which would not run a…

> yet still easily get certs for things like imap.example.com - which would not run a web server.

Well, depending on the OS, you could start up a web server during the LE verification process and then bring it down once that's done. You'd only have to run in on port 80 for probably less than a minute.

But yes, you could this mechanism to have "_acme-challenge.imap.example.com" (which is what the ACME protocol uses) be a CNAME to point to something.auth.example.com that is more dynamic. Or even a completely different domain like foo.bar.example.ORG.

In your example.com zone file you'd put NS and A(AAA) records to point to the DNS server that handles the queries for the auth sub-domain.

> And also split cert renewal to vps/container isolated from things like smtp/imap that need the certs.

It's easier to run the ACME client on the host in question, and I'm not sure what it gains you to have it run somewhere else. That being said, there are ACME clients with a bit of a focus on being run 'remotely' from where the certs actually live:

* https://github.com/srvrco/getssl

This is probably for shared-hosting scenarios where cron is not accessible.

IMHO though, if you have access to the CLI on the host running the TLS service, it's best to run things there.

Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt

#93

Post by e12e » Fri, Sep 04, 2020, 5:59 PM UTC

throw0101a wrote: post #92

e12e wrote: post #81

Earlier quoted context omitted.

Ok, thank you for the details and managing expectations. This still seems to warrant some experimentation. In my case I'm mostly interested in delegating a domain/sub-domain somewhere I can easily update (be that run my own dns, host it somewhere with an api) - while having my main domains on a more boring/static dns infrastructure - yet still easily get certs for things like imap.example.com - which would not run a…

> yet still easily get certs for things like imap.example.com - which would not run a web server. Well, depending on the OS, you could start up a web server during the LE verification process and then bring it down once that's done. You'd only have to run in on port 80 for probably less than a minute. But yes, you could this mechanism to have " _acme-challenge.imap.example.com " (which is what the ACME protocol uses)…

Re: your latest point - typically I'd like imap/smptd to run in separate static containers/vms with read access to the cert, but not write (and a volume or db to write emails to etc).

In general I'd prefer the certs be something the services get via configuration mgmnt - while the cert service can run via cron and make sure certs are valid an present.

In particular, I don't want my smtpd server to have write access to my dns, if I can help it.

Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt

#94

Post by creztoe » Sat, Sep 05, 2020, 3:42 PM UTC

tialaramex wrote: post #42

creztoe wrote: post #26

Earlier quoted context omitted.

I think you are half correct. The gateway has nothing to do with verifying the file during a DNS challenge. However, the IP of the machine requesting the cert IS saved with that cert information and made public. Let's encrypt will even warn you during the verification process.

The IP of the machine requesting the certificate is recorded by Let's Encrypt, but it is not (ordinarily) made public and certainly isn't (as you can see by inspecting it for yourself) saved with the certificate information. ISRG is required to keep enough information about the issuances they make to allow them to usefully diagnose problems after the fact. Ideally when we discover a problem it will be possible for th…

Yeah, I was referring to the certbot warning of "logging" the IP publicly. But I guess that policy never actually came to fruition. Thanks for the clarification!