Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
1–10 of 94 posts
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#2Cert-manager has great support for a number of providers[0] including AWS, CloudFlare, Google Cloud, and Azure.
I recommend this not just for internal IP setups, for actually for all setups, since DNS verification is more robust than HTTP verification, particularly if you have issues with load balancers, or if Let's Encrypt decides to deprecate a protocol again [1].
[0] https://cert-manager.io/docs/configuration/acme/dns01/#suppo... [1] https://community.letsencrypt.org/t/upcoming-tls-sni-depreca...
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#3Keep in mind, adding local entries to your external DNS will expose internal details of your network, such as hostnames and IPs. Same goes for Let's Encrypt, due to Certificate Transparency logging.
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#4Keep in mind, adding local entries to your external DNS will expose internal details of your network, such as hostnames and IPs. Same goes for Let's Encrypt, due to Certificate Transparency logging.
While you'll get the hostnames leaked - you could register them as fake addresses (say an A record for 192.168.0.1 for every address), and have a local DNS server overriding with the real addresses.
Whether this is worthwhile or not is debatable. Is the fact your internal server 'gubbins.mydomain.com' exists, or even that it exists on 10.0.41.43 really much use?
The other option for internal certificates is to get a wildcard of *.internal.mydomain.com, and spread that wildcard certificate around your network.
The final solution is run your own certificate authority and trust it on every browser. For some reason when you import a root certificate you can't typically allow that CA to only be used to authenticate a given subdomain. There are x509 constraints you can use in setting up the CA, but that's rare too, and I'm not sure every tool uses it.
In any case, if you go for an internal DNS provision, make sure you set use-application-dns.net to NXDOMAIN on your internal dns server to override DoH too
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#5Keep in mind, adding local entries to your external DNS will expose internal details of your network, such as hostnames and IPs. Same goes for Let's Encrypt, due to Certificate Transparency logging.
You'd actually end up with a 'split horizon' setup wherein LetsEncrypt (and the public) see those DNS names with the external gateway's IP and ping that for the validation files.
Your options at that point are a central 'well known' directory that different hosts can write to (I recommend sshfs), different directories on one host that are checked for any valid file in any of them (by default) or by hostname match in specific, etc. The details depend on your security model.
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#6[deleted]
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#7Keep in mind, adding local entries to your external DNS will expose internal details of your network, such as hostnames and IPs. Same goes for Let's Encrypt, due to Certificate Transparency logging.
for the domain problem I use wildcard dns.
for IP I dont think lets encrypt logging the ip address publicly (let me know if I wrong about it), since I use dns-01 I can generate SSL from anywhere.
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#8Keep in mind, adding local entries to your external DNS will expose internal details of your network, such as hostnames and IPs. Same goes for Let's Encrypt, due to Certificate Transparency logging.
You'd actually end up with a 'split horizon' setup wherein LetsEncrypt (and the public) see those DNS names with the external gateway's IP and ping that for the validation files. Your options at that point are a central 'well known' directory that different hosts can write to (I recommend sshfs), different directories on one host that are checked for any valid file in any of them (by default) or by hostname match in…
In this case, I don’t think there is a gateway involved at all. I believe Let’s encrypt is verifying the authors domains by (essentially) querying their selected DNS provider to prove ownership over a domain, which resolved to a private IP.
So iiuc there is no split horizon, it’s just that the sites would only work for the author.
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#9I haven't tried it yet but if you have control of your DNS and want automation:
https://github.com/joohoi/acme-dns/
https://github.com/joohoi/acme-dns-certbot
A simplified DNS server with a RESTful HTTP API to provide a simple way to automate ACME DNS challenges.
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#10Cert-manager has great support for a number of providers[0] including AWS, CloudFlare, Google Cloud, and Azure. I recommend this not just for internal IP setups, for actually for all setups, since DNS verification is more robust than HTTP verification, particularly if you have issues with load balancers, or if Let's Encrypt decides to deprecate a protocol again [1]. [0] https://cert-manager.io/docs/configuration/acme…
Verification via DNS is not without issues. If you have more then one DNS server the verification record need to propagate to all servers. If you for example use anycast DNS you will run into issues. Letsencrypt uses Google name servers for lookup which is problematic because they do not behave, they will for example not try secondary dns servers if the first try fail, making the Letsencrypt verification also fail. And because of these issues and if you have many domains you will quickly reach Letsencrypt quota.