Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Should you use Let's Encrypt for internal hostnames?

shkspr.mobi

Post reply on HN
Print view View original

21–30 of 198 posts

Re: Should you use Let's Encrypt for internal hostnames?

#21

Post by ChrisMarshallNY »

This is an interesting topic, for me.

I write iOS apps, and iOS requires that all internet communications be done with HTTPS.

It is possible to use self-signed certs, but you need to do a bit of work on the software, to validate and approve them. I don't like doing that, as I consider it a potential security vector (you are constantly reading about development code that is compiled into release product, and subsequently leveraged by crooks).

I am working on a full-stack system. I can run the backend on my laptop, but the app won't connect to it, unless I do the self-signed workaround.

It's easier for me to just leave the backend on the hosted server. I hardly ever need to work on that part.

Re: Should you use Let's Encrypt for internal hostnames?

#22

Post by formerly_proven »

Mister_Snuggles wrote: post #10

> The only real answer to this is to use Wildcard Certificates. You can get a TLS certificate for *.internal.example.com Does Let's Encrypt support Subject Alt Names on the wildcard certs? My experience suggests that wildcard certs work, but require a SAN entry for each "real" host because browsers don't trust the CN field anymore. e.g., my *.apps.blah cert doesn't work unless I include all of the things I use it on…

The whole point of a wildcard certificate is that you don't have to exhaustively list all covered hostnames.

Re: Should you use Let's Encrypt for internal hostnames?

#23

Post by zrail »

justusthane wrote: post #19
imadethis wrote: post #6

This seems like a perfect use case for wild card certs, especially if you have internal sites on a different (sub) domain from your prod servers. Yes, multiple servers have the same private key, but when the alternative is self-signed or no encryption, that is an easy trade off for me.

I don't know how LE does it, but at least with DigiCert (and I assume other commercial CAs), servers sharing the same wildcard cert don't have to share a private key. You generate a separate CSR from each server, and then request a duplicate copy of the wildcard cert using that CSR. That way they can have different SANs as well.

Wildcard certs are (only?) issued from DNS-01 challenges. As long as the requester can satisfy the DNS challenge ACME doesn't care about key uniqueness.

Re: Should you use Let's Encrypt for internal hostnames?

#24

Post by corobo »

mrweasel wrote: post #5
meepmorp wrote: post #2

I've used https://smallstep.com/docs/step-ca/ as a CA internally, works well.

What I'd want is an internal CA, like step-ca, but have the certificates signed by a "real" CA, so I don't have to distribute my own root CA certificate.

Wouldn't that allow you to issue certificates for Google.com? Correct me if I've misunderstood but for the sake of discussion pretend cert pinning doesn't exist, use another example domain if it's easier

Re: Should you use Let's Encrypt for internal hostnames?

#25

Post by dsr_ »

zrail wrote: post #23
justusthane wrote: post #19

Earlier quoted context omitted.

I don't know how LE does it, but at least with DigiCert (and I assume other commercial CAs), servers sharing the same wildcard cert don't have to share a private key. You generate a separate CSR from each server, and then request a duplicate copy of the wildcard cert using that CSR. That way they can have different SANs as well.

Wildcard certs are (only?) issued from DNS-01 challenges. As long as the requester can satisfy the DNS challenge ACME doesn't care about key uniqueness.

Right. If you control the DNS, you can point names at any IP address and get appropriate certs for them. Therefore, you must protect your DNS infrastructure.

Re: Should you use Let's Encrypt for internal hostnames?

#26

Post by 0x0 »

ChrisMarshallNY wrote: post #21

This is an interesting topic, for me. I write iOS apps, and iOS requires that all internet communications be done with HTTPS. It is possible to use self-signed certs, but you need to do a bit of work on the software, to validate and approve them. I don't like doing that, as I consider it a potential security vector (you are constantly reading about development code that is compiled into release product, and subsequen…

If you create a custom SSL CA, you can add that CA to your ios devices and simulators, and they will trust your backend served with an SSL certificate issued by your custom CA, no app modifications needed. (On modern Android, this does not work out of the box - it requires the custom SSL CA fingerprints to be added to a network configuration file embedded in the app - but you could always use gradle flavors and only add it to your debug/development builds)

Re: Should you use Let's Encrypt for internal hostnames?

#28

Post by michaelt »

filleokus wrote: post #8

Sadly, the answer is probably no (for the information leakage mentioned in the article). But having an internal (even ACME API-supporting) CA is no walk in the park either. If you can swallow the trade off and design with publicly-known hostnames, I would highly recommend it. There’s always some annoying device/software/framework requiring their own little config dance to insert the root cert. Like outbound-proxy con…

> Sadly, the answer is probably no (for the information leakage mentioned in the article).

Eh, even in large organisations of expert IT users, the internal CA ends up training users to ignore certificate warnings.

Sure, maybe the certificate is set up right on officially issued laptops - but the moment someone starts a container, or launches a virtual machine, or uses some weird tool with its own certificate store, or has a project that needs a raspberry pi, or the boss gets himself an ipad? They'll start seeing certificate errors.

IMHO the risks created by users learning to ignore warnings are much greater than the risks from some outsider knowing that nexus.example.com exists.

Re: Should you use Let's Encrypt for internal hostnames?

#29

Post by dsr_ »

mrweasel wrote: post #5
meepmorp wrote: post #2

I've used https://smallstep.com/docs/step-ca/ as a CA internally, works well.

What I'd want is an internal CA, like step-ca, but have the certificates signed by a "real" CA, so I don't have to distribute my own root CA certificate.

That would be a violation of the real CA's duty to only sign certs that they have some basis for believing are correct. (This basis almost always boils down to "controls the DNS".)

Re: Should you use Let's Encrypt for internal hostnames?

#30

Post by LeSaucy »

magicalhippo wrote: post #3

I've done it with a few key services like Home Assistant, using split-horizon DNS, and considered it less than ideal. However the alternatives suck as far as I know. I don't want to install my own CA certificate on all the various devices in the home, for instance, and keeping that up to date. With browsers making self-signing a PITA, what choices do I have?

Not just browsers, but also iOS/android.
Post reply on HN