11–20 of 198 posts
Uhm, or you use split horizon DNS? Who in their right mind would leak all their internal DNS names into a public DNS zone?
> The only real answer to this is to use Wildcard Certificates. You can get a TLS certificate for *.internal.example.com Does Let's Encrypt support Subject Alt Names on the wildcard certs? My experience suggests that wildcard certs work, but require a SAN entry for each "real" host because browsers don't trust the CN field anymore. e.g., my *.apps.blah cert doesn't work unless I include all of the things I use it on…
Earlier quoted context omitted.
What I'd want is an internal CA, like step-ca, but have the certificates signed by a "real" CA, so I don't have to distribute my own root CA certificate.
The dream would truly be an internal CA backed by a publicly trusted subordinate cert (limited to the domain you control). But afaik that can’t happen until the Name Constraint Extension is enforced by “all” clients.
> OK, so you decide to have an internal DNS - now the whole world knows you have doorbell-model-xyz.myhome.example.com! Uhm, or you use split horizon DNS? Who in their right mind would leak all their internal DNS names into a public DNS zone?
> The only real answer to this is to use Wildcard Certificates. You can get a TLS certificate for *.internal.example.com Does Let's Encrypt support Subject Alt Names on the wildcard certs? My experience suggests that wildcard certs work, but require a SAN entry for each "real" host because browsers don't trust the CN field anymore. e.g., my *.apps.blah cert doesn't work unless I include all of the things I use it on…
> OK, so you decide to have an internal DNS - now the whole world knows you have doorbell-model-xyz.myhome.example.com! Uhm, or you use split horizon DNS? Who in their right mind would leak all their internal DNS names into a public DNS zone?
> OK, so you decide to have an internal DNS - now the whole world knows you have doorbell-model-xyz.myhome.example.com! Uhm, or you use split horizon DNS? Who in their right mind would leak all their internal DNS names into a public DNS zone?
“View Certificate” in a browser, or openssl sclient on cli will show you.
> OK, so you decide to have an internal DNS - now the whole world knows you have doorbell-model-xyz.myhome.example.com! Uhm, or you use split horizon DNS? Who in their right mind would leak all their internal DNS names into a public DNS zone?
This seems like a perfect use case for wild card certs, especially if you have internal sites on a different (sub) domain from your prod servers. Yes, multiple servers have the same private key, but when the alternative is self-signed or no encryption, that is an easy trade off for me.
> OK, so you decide to have an internal DNS - now the whole world knows you have doorbell-model-xyz.myhome.example.com! Uhm, or you use split horizon DNS? Who in their right mind would leak all their internal DNS names into a public DNS zone?