Should you use Let's Encrypt for internal hostnames? • Hacker News Board

Re: Should you use Let's Encrypt for internal hostnames?

#31

Post by mrweasel » Wed, Jan 05, 2022, 3:19 PM UTC

corobo wrote: post #24

mrweasel wrote: post #5

Earlier quoted context omitted.

What I'd want is an internal CA, like step-ca, but have the certificates signed by a "real" CA, so I don't have to distribute my own root CA certificate.

Wouldn't that allow you to issue certificates for Google.com? Correct me if I've misunderstood but for the sake of discussion pretend cert pinning doesn't exist, use another example domain if it's easier

I'm not a 100% sure how certificates work. What I imagined would be possible is having a certificate for mydomain.com, which can be used to sign certificates for subdomains.

Re: Should you use Let's Encrypt for internal hostnames?

#32

Post by chedabob » Wed, Jan 05, 2022, 3:20 PM UTC

ChrisMarshallNY wrote: post #21

This is an interesting topic, for me. I write iOS apps, and iOS requires that all internet communications be done with HTTPS. It is possible to use self-signed certs, but you need to do a bit of work on the software, to validate and approve them. I don't like doing that, as I consider it a potential security vector (you are constantly reading about development code that is compiled into release product, and subsequen…

For the project I'm working on currently, I use Charles Proxy's "Map Remote" function to map our UAT server's HTTPS url to my local machines HTTP URL.

Also ngrok.com works really well if you need to give other people access to your dev environment.

Re: Should you use Let's Encrypt for internal hostnames?

#33

Post by jeremyjh » Wed, Jan 05, 2022, 3:24 PM UTC

thrower123 wrote: post #27

Is it that hard to setup an internal CA? I have no idea what I'm doing, and I managed one for years until we moved offices and ditched our LAN.

The hard part is getting the root certificate in the trust store on every device in your organization.

Re: Should you use Let's Encrypt for internal hostnames?

#34

Post by Hamuko » Wed, Jan 05, 2022, 3:29 PM UTC

dsr_ wrote: post #25

zrail wrote: post #23

Earlier quoted context omitted.

Wildcard certs are (only?) issued from DNS-01 challenges. As long as the requester can satisfy the DNS challenge ACME doesn't care about key uniqueness.

Right. If you control the DNS, you can point names at any IP address and get appropriate certs for them. Therefore, you must protect your DNS infrastructure.

Isn't the need to protect your DNS infrastructure pretty obvious anyways even when ignoring certificate validation?

Re: Should you use Let's Encrypt for internal hostnames?

#35

Post by mojzu » Wed, Jan 05, 2022, 3:29 PM UTC

meepmorp wrote: post #2

I've used https://smallstep.com/docs/step-ca/ as a CA internally, works well.

I've been using it too and it works well, particularly with Caddy to do automatic certificates with ACME where possible

Plus all my services go through Tailscale, so although I am leaking internal hostnames via DNS, all those records point to is 100.* addresses

Re: Should you use Let's Encrypt for internal hostnames?

#36

Post by flatiron » Wed, Jan 05, 2022, 3:30 PM UTC

michaelt wrote: post #28

filleokus wrote: post #8

Sadly, the answer is probably no (for the information leakage mentioned in the article). But having an internal (even ACME API-supporting) CA is no walk in the park either. If you can swallow the trade off and design with publicly-known hostnames, I would highly recommend it. There’s always some annoying device/software/framework requiring their own little config dance to insert the root cert. Like outbound-proxy con…

> Sadly, the answer is probably no (for the information leakage mentioned in the article). Eh, even in large organisations of expert IT users, the internal CA ends up training users to ignore certificate warnings. Sure, maybe the certificate is set up right on officially issued laptops - but the moment someone starts a container, or launches a virtual machine, or uses some weird tool with its own certificate store, o…

If you have a large organization your containers are based off the orgs containers which has the CA in it. Same with VMs, Java, .Net, etc.

Re: Should you use Let's Encrypt for internal hostnames?

#37

Post by mcgeez » Wed, Jan 05, 2022, 3:30 PM UTC

I like the wildcard certificates option, however I have not been able to find an easy solution to distribute those certificates to every host I have internally. Is this usually done manually? is there some equivalent to acme.sh?

The kind of hosts I have are OPNSense router, traefik servers, unifi controller etc.

Re: Should you use Let's Encrypt for internal hostnames?

#38

Post by gregmac » Wed, Jan 05, 2022, 3:34 PM UTC

Mister_Snuggles wrote: post #10

> The only real answer to this is to use Wildcard Certificates. You can get a TLS certificate for *.internal.example.com Does Let's Encrypt support Subject Alt Names on the wildcard certs? My experience suggests that wildcard certs work, but require a SAN entry for each "real" host because browsers don't trust the CN field anymore. e.g., my *.apps.blah cert doesn't work unless I include all of the things I use it on…

This sounds like something is broken in your client (or maybe server config)?

I use Let's Encrypt wildcard certs quite extensively, both in production use at $dayjob and on my home network, and have never encountered anything like this. The only "trick" to wildcard certs is one for .apps.blah won't be valid for apps.blah. The normal way to handle this is request one with SANs .apps.blah and apps.blah.

Similarly, it won't work for sub1.sub2.apps.blah. I don't run setups like this myself but if you need it I'd recommend using a separate *.sub2.apps.blah for that, mainly due to the potential for DNS issues when LE is validating. Same thing with multiple top-level domains. The reason is when renewing if one of N validations fail, your certificate gets re-issued without the failed domain which then means broken SSL. If you have completely separate certificates and validation of one fails the old (working) version stays in place. With normal renewals happening at 30 days before expiry, this means you have 29 days for this to resolve on its own, manually fix, etc, and LE even emails you a few days before expiry if a certificate hasn't been renewed.

Re: Should you use Let's Encrypt for internal hostnames?

#39

Post by jasonjayr » Wed, Jan 05, 2022, 3:37 PM UTC

mcgeez wrote: post #37

I like the wildcard certificates option, however I have not been able to find an easy solution to distribute those certificates to every host I have internally. Is this usually done manually? is there some equivalent to acme.sh? The kind of hosts I have are OPNSense router, traefik servers, unifi controller etc.

For any device that has a web interface, and no way of updating the cert automatically built in or via an API, you'd probably have to automate the process with something like puppeteer.

https://www.npmjs.com/package/puppeteer

Re: Should you use Let's Encrypt for internal hostnames?

#40

Post by Hamuko » Wed, Jan 05, 2022, 3:38 PM UTC

I'm using a wildcard certificate and CNAME records to interal hostnames, it works pretty nicely for my use case. I don't need to leak out a map of my hostnames and I don't need to do a full split-horizon DNS.

So if I want to encrypt traffic to "service1.example.com", "service2.example.com" and "service3.example.com" that all run on server A, I'll make three CNAME records that all point to "server-a.internal", and I'll just resolve "server-a.internal" in my local network. Obviously, anyone can query what "service1.example.com" points to, but they won't figure out anything beyond "server A".