Lets encrypt has made SSL/TLS a no-brainer for websites on the public internet. Behind home routers, it's still a tedious topic. What's your (non-enterprise) solution?
Ask HN: What's your solution for SSL on internal servers?
1–10 of 79 posts
Re: Ask HN: What's your solution for SSL on internal servers?
#2[deleted]
Re: Ask HN: What's your solution for SSL on internal servers?
#3Personally I avoid it where I can and use wireguard for all internal traffic. Hopefully someone more knowledgeable here can tell me if it's a good or bad idea.
Re: Ask HN: What's your solution for SSL on internal servers?
#4I'm using subdomains on a domain I own and request Let's Encrypt certificates with the DNS challenge.
Re: Ask HN: What's your solution for SSL on internal servers?
#5SPIFFE: https://spiffe.io/
Re: Ask HN: What's your solution for SSL on internal servers?
#6For a long time I was all fussy about having to create a security exception for self-signed certificates. One day I realized I was acting insane, as if there was some glorious principle involved. There isn't.
I trust my own (or coworkers) certificates. It's a dev site for heavens sake.
Ever since, ssh-keygen all the way.
Re: Ask HN: What's your solution for SSL on internal servers?
#7For a long time I was all fussy about having to create a security exception for self-signed certificates. One day I realized I was acting insane, as if there was some glorious principle involved. There isn't. I trust my own (or coworkers) certificates. It's a dev site for heavens sake. Ever since, ssh-keygen all the way.
It appears to me the issue is browser warning dialogs that imply it is always very dangerous. There should be either more context explained in those dialogs or a recognition of/mode for sites that are supposed to be self signed.
Re: Ask HN: What's your solution for SSL on internal servers?
#8I'm using subdomains on a domain I own and request Let's Encrypt certificates with the DNS challenge.
Then you're routing internal traffic through a public IP? Or do they support wildcard certs?
Re: Ask HN: What's your solution for SSL on internal servers?
#9I'm using subdomains on a domain I own and request Let's Encrypt certificates with the DNS challenge.
Seconding this approach.
Re: Ask HN: What's your solution for SSL on internal servers?
#10I'm using subdomains on a domain I own and request Let's Encrypt certificates with the DNS challenge.
Yeah, this is the way to go. If your DNS provider doesn't let you setup limited scope access tokens, then you can use something like acme-dns with delegated dns challenges, as long as you have a single external server.