Ask HN: What's your solution for SSL on internal servers? • Hacker News Board

Re: Ask HN: What's your solution for SSL on internal servers?

#51

Post by gjvnq » Wed, Feb 09, 2022, 3:03 PM UTC

yosamino wrote: post #29

I have a private CA for all internal hosts. It's a bit of a pain to run, but it's neccessary because "internal" includes VMs that run colocated servers and many services to mutual authentication. It's hyper annoying that it's barely to not possible to include our own CA into mobile Browsers so that they can use internal websites. The alternative would be to depend on LE where neccessary, but this introduces an extern…

Why not have your applications accessible through two URLs with yor CA and another with LetsEncrypt.

Also, it may be possible to sign an SSL certificate with two authorities.

Re: Ask HN: What's your solution for SSL on internal servers?

#52

Post by xoa » Wed, Feb 09, 2022, 3:13 PM UTC

yosamino wrote: post #29

I have a private CA for all internal hosts. It's a bit of a pain to run, but it's neccessary because "internal" includes VMs that run colocated servers and many services to mutual authentication. It's hyper annoying that it's barely to not possible to include our own CA into mobile Browsers so that they can use internal websites. The alternative would be to depend on LE where neccessary, but this introduces an extern…

>It's hyper annoying that it's barely to not possible to include our own CA into mobile Browsers so that they can use internal websites.

You can? Any MDM should be able to deploy internal CAs, and at least on iPhones the free Apple Configurator 2 software will let you make profiles you can then easily deploy a bunch of ways. Doesn't scale easily but it's free and easy for small numbers. Also very useful period even for an individual or family to bootstrap devices and make changes if you've got significant numbers of email accounts for example. I'm sure Android has some equivalent.

Re: Ask HN: What's your solution for SSL on internal servers?

#53

Post by chenxiaolong » Wed, Feb 09, 2022, 3:13 PM UTC

None of my self-hosted things are internet facing, so I use the DNS-01 challenge type. For internal DNS, I run the powerdns authoritative server. Each ACME client uses RFC2136 (TSIG) to update the _acme-challenge TXT record. I have a pdns lua policy script set up so that the only record that's allowed to be updated is the TXT record matching the TSIG name.

To allow Let's Encrypt to hit the DNS server, I run a public-facing dnsdist load balancer. It forwards the relevant TXT, CAA, DNSKEY, and NS queries to pdns and silently drops all other queries not required for ACME challenges.

I'd prefer that the internal hostnames wouldn't be leaked in the certificate transparency logs, but given that no services are exposed to the internet, it doesn't bother me enough to look for alternatives (eg. wildcard certs).

Re: Ask HN: What's your solution for SSL on internal servers?

#54

Post by wolrah » Wed, Feb 09, 2022, 3:22 PM UTC

larcher wrote: post #38

throwaway22032 wrote: post #24

Earlier quoted context omitted.

You just resolve the domain to a private IP on your internal network, Let's Encrypt can see it as whatever you want, for all they care it's 1.1.1.1.

Friendly reminder that 1.1.1.1 is a real, valid, public IP. Seen plenty of networks that don’t recognize this, use it for some internal purpose, and break https://1.1.1.1/

> Seen plenty of networks that don’t recognize this, use it for some internal purpose, and break https://1.1.1.1/

AFAIK Cisco used 1.1.1.1 as an example "dummy" IP in their wireless LAN controller documentation, which of course led to infinite idiots copy/pasting exactly that and setting up broken networks.

Re: Ask HN: What's your solution for SSL on internal servers?

#55

Post by AtlasBarfed » Wed, Feb 09, 2022, 3:29 PM UTC

This all comes down to two things:

- keytool and openssh absolutely suck from a usability standpoint

- testing the pipeline of generation of keys/files/certs/stores and importing/generating/signing etc is difficult

- error messages, if you get them, are completely unhelpful, and often the errors are superficially not even ssl/security related.

Every time I do SSL, it is a 1-4 day job, and that's with StackOverflow saving my ass on translating "why this weird error means this failure".

Between the above two issues, SSL on every platform, application, database, operating system (or version of OS) has different errors.

If you have a non-mainstream language, I have NO IDEA how you would get SSL up. Python, JVM, javascript, C/C++ there's a lot of eyeballs on this.

Re: Ask HN: What's your solution for SSL on internal servers?

#56

Post by bravetraveler » Wed, Feb 09, 2022, 3:33 PM UTC

I still pay for wildcard certs on a few domains; it's crazy - I know, I just haven't bothered to jump over to LE and add it to the list of things to mind.

For some services I'll put them behind those domains and simply use the appropriate certificate.

Generally though if this is strictly internal, my domain can issue internally trusted certificates.

Re: Ask HN: What's your solution for SSL on internal servers?

#57

Post by madduci » Wed, Feb 09, 2022, 3:42 PM UTC

A private PKI using Ejbca Community Edition from Primekey. Pretty solid.

Another one is step-ca

Re: Ask HN: What's your solution for SSL on internal servers?

#58

Post by captn3m0 » Wed, Feb 09, 2022, 4:00 PM UTC

Wildcard certificate using Traefik on a secondary domain generated using DNS challenge. Since this gives Traefik too much permissions to my DNS (CloudFlare now has better RBAC, but I haven't switched to it) - I use a secondary domain for my homeserver.

For the few services where I want to use my primary domain, I run dehydrated once in a while from my local setup (which uses my password manager on a script). These services do end up exposed publicly on the CT Logs, but I'm okay with that.

I proxy these services over a DO VPN, but resolve these internally to private IPs using NextDNS. There's also a internal domain for every service (service.in.example.com resolves to internal IP and service.example.com resolves to public IP, and service.example.com resolves to the private IP within my home network)

Re: Ask HN: What's your solution for SSL on internal servers?

#59

Post by sdevonoes » Wed, Feb 09, 2022, 4:04 PM UTC

Good question. I'm also interested. My use case would be:

- a have an nginx server load balancing traffic between N web servers that talk to one DB. Everything is inside a VPC (I'm using digital ocean), and only nginx is public to the internet

One approach I have read is that I could terminate SSL at the nginx level, and handle normal http between my web servers. Question would be: how secure is that? Can I (should I) trust that everything within my VPC is only accessible to me? Is terminating SSL good enough when handling, let's say, account creations and payments via Stripe?

Re: Ask HN: What's your solution for SSL on internal servers?

#60

Post by 9wzYQbTYsAIc » Wed, Feb 09, 2022, 4:07 PM UTC

I use an internal subdomain wildcard certificate (e.g., *.internal.example.com) and traditional methods of configuring ssl for internal services / sites on the internal servers.

For cases where the service or site doesn’t natively support ssl, I run a local reverse proxy with the above certificate.