Earlier quoted context omitted.
He’s using it as a subdomain.
Which can still cause problems depending on your search domain setting and resolver client
Could you give an example? I'm curious, too.
TLS certificates for internal services done right
111–120 of 177 posts
Re: TLS certificates for internal services done right
#112Re: TLS certificates for internal services done right
#113Earlier quoted context omitted.
I never understood the issue with DNS-01. if you have a process that you trust to maintain a zone's TLS identity what is the big deal about letting it control a record in that zone?
We have a few subdomains for white labeling 3rd party SaaS where we do what is basically the AWS ACM equivalent and add a persistent record from a vendor. With this setup, I don't have to grant 3rd parties DNS access. I actually made a webhook that allows per hostname API keys to wrap dnsimple because they only had per zone keys and I didn't want each VM to have access to the entire zone. These challenges would have…
You could already do that by setting a _acme-challenge alias CNAME record, so you can point it to a domain that they control. It's a bit finnicky and the new setup definitely looks better for whitelabelling, but there are current workarounds; although it does still involve client DNS access, you can put it onto a zone that has no risks
Re: TLS certificates for internal services done right
#114Split brain =/= done right.
This introduces all sorts of aberrant behavior. Most notably that clients will get different responses depending on their query and route that you now have to test for. It also is a “silent” deviation for audiences that may not be aware of.
I’m not sure what problem that is trying to be solved here? That the OP wanted internal users seeing a different site than external users? Or using a different route in? In both those cases the correct user behavior is to use a different DNS record.
Re: TLS certificates for internal services done right
#115Earlier quoted context omitted.
Personally, I use a custom local CA with name constraints so that it can only sign domains for The .internal TLD. This is the most important bit: because if the cert is ever leaked, it cannot be used to MITM connections to other domains. I have to secure the CA's key, but I also have to secure all the keys for the certificate it signs, both being a similar level of challenge. For personal use, or for very small organ…
Yubi makes an 'actual' HSM product: * https://www.yubico.com/products/hardware-security-module/ See also perhaps less expensive option: * https://shop.nitrokey.com/shop/nkhs2-nitrokey-hsm-2-7
I am planning on fiddling with using the TPM of an old dell 5820 I've got floating around my house as a budget HSM.
It looks possible, on paper, if you don't poke at it too often.
Re: TLS certificates for internal services done right
#116The relative proximity of the words "done right" and "split-horizon DNS" makes my insides hurt a little bit. Use DNS validation to allow these internal services to pull ACME certs. There's so much less headache, long-term. Split-horizon DNS (and the tedious make-work it can create when you start needing to mirror public-accessibly records in the private DNS) has always been something to aspire to move away from in my…
... Could you please provide a solution? What should I do in my homelab?
Saying something isn't bad without pointing to right direction makes my insides hurt a little bit.
Re: TLS certificates for internal services done right
#117[dead]
Re: TLS certificates for internal services done right
#118I am looking forward to finally using DNS-PERSIST-01 for validation. No more dynamic DNS updates, DNS credentials or forwarding necessary.
Sadly most tools still doesn't support it: https://github.com/cert-manager/cert-manager/issues/8373#iss...
And then the issue is protecting the private key of the issuer and monitoring certificates (it's a good idea to do that anyway).
Re: TLS certificates for internal services done right
#119The relative proximity of the words "done right" and "split-horizon DNS" makes my insides hurt a little bit. Use DNS validation to allow these internal services to pull ACME certs. There's so much less headache, long-term. Split-horizon DNS (and the tedious make-work it can create when you start needing to mirror public-accessibly records in the private DNS) has always been something to aspire to move away from in my…
Yes - literally just pick the right Caddy (or similar) image with Let's Encrypt client included - and you can simply add a tag/label to your docker compose files for each of self hosted services to get a real SSL, that auto renewed ...etc. With one of self hosted services being Adguard-Home can do both ADs blocking and internal DNS... The public DNS records for your "internal use only" domain remain empty.
[dead]
Re: TLS certificates for internal services done right
#120I wonder if the author realizes that getting public certificates results in them being recorded in CT logs.
Yep. Especially with non-wildcard certs this leaks all service names (privacy concern).