Should you use Let's Encrypt for internal hostnames?
1–10 of 198 posts
Re: Should you use Let's Encrypt for internal hostnames?
#2I've used https://smallstep.com/docs/step-ca/ as a CA internally, works well.
Re: Should you use Let's Encrypt for internal hostnames?
#3I've done it with a few key services like Home Assistant, using split-horizon DNS, and considered it less than ideal.
However the alternatives suck as far as I know. I don't want to install my own CA certificate on all the various devices in the home, for instance, and keeping that up to date.
With browsers making self-signing a PITA, what choices do I have?
Re: Should you use Let's Encrypt for internal hostnames?
#4[deleted]
Re: Should you use Let's Encrypt for internal hostnames?
#5I've used https://smallstep.com/docs/step-ca/ as a CA internally, works well.
What I'd want is an internal CA, like step-ca, but have the certificates signed by a "real" CA, so I don't have to distribute my own root CA certificate.
Re: Should you use Let's Encrypt for internal hostnames?
#6This seems like a perfect use case for wild card certs, especially if you have internal sites on a different (sub) domain from your prod servers. Yes, multiple servers have the same private key, but when the alternative is self-signed or no encryption, that is an easy trade off for me.
Re: Should you use Let's Encrypt for internal hostnames?
#7I've used https://smallstep.com/docs/step-ca/ as a CA internally, works well.
I've been setting this up for my homelab under .home.arpa, seems to work pretty well so far.
Re: Should you use Let's Encrypt for internal hostnames?
#8Sadly, the answer is probably no (for the information leakage mentioned in the article).
But having an internal (even ACME API-supporting) CA is no walk in the park either. If you can swallow the trade off and design with publicly-known hostnames, I would highly recommend it.
There’s always some annoying device/software/framework requiring their own little config dance to insert the root cert. Like outbound-proxy configuration, but almost worse.
I don’t even want to imagine what would happen if/when the root key needs to be rotated due to some catastrophic HSM problem.
Re: Should you use Let's Encrypt for internal hostnames?
#9I've used https://smallstep.com/docs/step-ca/ as a CA internally, works well.
What I'd want is an internal CA, like step-ca, but have the certificates signed by a "real" CA, so I don't have to distribute my own root CA certificate.
The dream would truly be an internal CA backed by a publicly trusted subordinate cert (limited to the domain you control). But afaik that can’t happen until the Name Constraint Extension is enforced by “all” clients.
Re: Should you use Let's Encrypt for internal hostnames?
#10> The only real answer to this is to use Wildcard Certificates. You can get a TLS certificate for *.internal.example.com
Does Let's Encrypt support Subject Alt Names on the wildcard certs?
My experience suggests that wildcard certs work, but require a SAN entry for each "real" host because browsers don't trust the CN field anymore. e.g., my *.apps.blah cert doesn't work unless I include all of the things I use it on - homeassistant.apps.blah, nodered.apps.blah, etc.
Do Let's Encrypt certificates have something special that negates this requirement? Or am I completely wrong about the SAN requirement?