Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt

techprowd.com

Post reply on HN
Print view View original

11–20 of 94 posts

Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt

#11

Post by cassianoleal »

iso1210 wrote: post #4
aforwardslash wrote: post #3

Keep in mind, adding local entries to your external DNS will expose internal details of your network, such as hostnames and IPs. Same goes for Let's Encrypt, due to Certificate Transparency logging.

While you'll get the hostnames leaked - you could register them as fake addresses (say an A record for 192.168.0.1 for every address), and have a local DNS server overriding with the real addresses. Whether this is worthwhile or not is debatable. Is the fact your internal server 'gubbins.mydomain.com' exists, or even that it exists on 10.0.41.43 really much use? The other option for internal certificates is to get a…

> Is the fact your internal server 'gubbins.mydomain.com' exists, or even that it exists on 10.0.41.43 really much use?

Pretty much this. What does it matter if you know certain hostnames or internal IPs on my network? It's all firewalled anyway, and if it wasn't it would be trivial to find them out on your own...

Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt

#12

Post by Xylakant »

cassianoleal wrote: post #11
iso1210 wrote: post #4

Earlier quoted context omitted.

While you'll get the hostnames leaked - you could register them as fake addresses (say an A record for 192.168.0.1 for every address), and have a local DNS server overriding with the real addresses. Whether this is worthwhile or not is debatable. Is the fact your internal server 'gubbins.mydomain.com' exists, or even that it exists on 10.0.41.43 really much use? The other option for internal certificates is to get a…

> Is the fact your internal server 'gubbins.mydomain.com' exists, or even that it exists on 10.0.41.43 really much use? Pretty much this. What does it matter if you know certain hostnames or internal IPs on my network? It's all firewalled anyway, and if it wasn't it would be trivial to find them out on your own...

It may be of interest for attackers that have no visibility into your network and make cross site attacks against you easier. For example, if I know that your router is available at router.network.internal, I might just try and see if your browser is logged in and send you a link to a page that starts making requests against that interface. Enumerating network resources can certainly be done via other ways, but DNS is a particularly easy one.

Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt

#13

Post by tialaramex »

lgbr wrote: post #2

Cert-manager has great support for a number of providers[0] including AWS, CloudFlare, Google Cloud, and Azure. I recommend this not just for internal IP setups, for actually for all setups, since DNS verification is more robust than HTTP verification, particularly if you have issues with load balancers, or if Let's Encrypt decides to deprecate a protocol again [1]. [0] https://cert-manager.io/docs/configuration/acme…

I like DNS challenges, but I don't see how it matters for deprecation of an ACME challenge type. The dns-01 challenge could just as easily for some reason need to be deprecated.

The two likely reasons for such deprecation would apply just as well:

1. Updated Baseline Requirements or a programme policy requirement at any of the major root trust stores could forbid this challenge or require it to be substantially modified, obsoleting it in its current form.

2. The BRs don't change but Let's Encrypt finds they need to adjust this particular implementation in a non-compatible way so they deprecate the current challenge.

It can be easier to do DNS challenges, but it can also be very rough, depending on all the moving parts in your system.

Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt

#14

Post by swiley »

I’ve tried to set up kubernetes at home a couple of times and I always freak out at the amount of layers and “just run this” style of tutorials. Am I crazy?

I’ve heard guix has some kind of container management thing. I’ve been thinking about trying it anyway.

Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt

#15

Post by user5994461 »

This page is raising a ton of security alerts:

"NoScript detected a potential Cross-Site Scripting attack from https://www.techprowd.com to https://carbon.now.sh"

Images are failing to load too. Not sure what's going on.

edit: Probably some misusing of DNS rather than actual attack but who knows. Author should fix the site.

Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt

#16

Post by Cthulhu_ »

aforwardslash wrote: post #3

Keep in mind, adding local entries to your external DNS will expose internal details of your network, such as hostnames and IPs. Same goes for Let's Encrypt, due to Certificate Transparency logging.

Is that actually valuable information though? I mean internal IP addresses are fairly generic (like the 192.168.x range mentioned in the article).

Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt

#17

Post by aasasd »

TLDR:

- have a proper worldwide domain

- obtain a certificate for that domain

- point the domain to local IPs in your network and use the certificate on the local server.

Doesn't change that you'd need to self-sign certs for .local or other funky domains.

Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt

#18

Post by vetinari »

iso1210 wrote: post #4
aforwardslash wrote: post #3

Keep in mind, adding local entries to your external DNS will expose internal details of your network, such as hostnames and IPs. Same goes for Let's Encrypt, due to Certificate Transparency logging.

While you'll get the hostnames leaked - you could register them as fake addresses (say an A record for 192.168.0.1 for every address), and have a local DNS server overriding with the real addresses. Whether this is worthwhile or not is debatable. Is the fact your internal server 'gubbins.mydomain.com' exists, or even that it exists on 10.0.41.43 really much use? The other option for internal certificates is to get a…

> when you import a root certificate you can't typically allow that CA to only be used to authenticate a given subdomain.

While, true, there are some workarounds, that are, ehm, workaroundy.

1. For _your_ domain, you can have CAA records in your DNS. (That solves it for your domains, not for others, if they do not use CAA)

2. Some CA implementations, like FreeIPA one, allow you to issue certificates only for your own domain. They will refuse to sign a certificate for any other domain.

So while it is not 100% solution, it is 80% one.

> In any case, if you go for an internal DNS provision, make sure you set use-application-dns.net to NXDOMAIN on your internal dns server to override DoH too

Also make sure that the browser honors this. Firefox honors canary domain only when in 'auto DoH' mode, but not, when the user has explicitly configured DoH. From https://support.mozilla.org/en-US/kb/canary-domain-use-appli...:

> The canary domain only applies to users who have DoH enabled as the default option. It does not apply for users who have made the choice to turn on DoH by themselves.

Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt

#19

Post by Xylakant »

user5994461 wrote: post #15

This page is raising a ton of security alerts: "NoScript detected a potential Cross-Site Scripting attack from https://www.techprowd.com to https://carbon.now.sh" Images are failing to load too. Not sure what's going on. edit: Probably some misusing of DNS rather than actual attack but who knows. Author should fix the site.

I think that's NoScript being overprotective. carbon.now.sh is a site that renders nice terminal sessions as html that you can include as iframes. - better than screenshots because you can actually copy the code. And as part of that request, the shell code is passed in the query string. I haven't investigated, but NoScript may be triggering on that.

Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt

#20

Post by aurimasniekis »

user5994461 wrote: post #15

This page is raising a ton of security alerts: "NoScript detected a potential Cross-Site Scripting attack from https://www.techprowd.com to https://carbon.now.sh" Images are failing to load too. Not sure what's going on. edit: Probably some misusing of DNS rather than actual attack but who knows. Author should fix the site.

It's hosted on Ghost Pro serviced blog platform. https://carbon.now.sh is those code blocks u see in the article it's code highlighter
Post reply on HN