Ask HN: What's your solution for SSL on internal servers? • Hacker News Board

Re: Ask HN: What's your solution for SSL on internal servers?

#11

Post by Macha » Wed, Feb 09, 2022, 1:38 PM UTC

viovanov wrote: post #8

dindresto wrote: post #4

I'm using subdomains on a domain I own and request Let's Encrypt certificates with the DNS challenge.

Then you're routing internal traffic through a public IP? Or do they support wildcard certs?

I have local DNS setup to resolve my personal domains to hosts on my home network. They do support wildcard certs, _only_ if you use some form of DNS challenge.

Re: Ask HN: What's your solution for SSL on internal servers?

#12

Post by bryanlarsen » Wed, Feb 09, 2022, 1:39 PM UTC

viovanov wrote: post #8

dindresto wrote: post #4

I'm using subdomains on a domain I own and request Let's Encrypt certificates with the DNS challenge.

Then you're routing internal traffic through a public IP? Or do they support wildcard certs?

SSL certificates contain the name, not the IP. So the IP address can be anything, including internal ones.

Re: Ask HN: What's your solution for SSL on internal servers?

#13

Post by jhugo » Wed, Feb 09, 2022, 1:41 PM UTC

I have a private CA (managed with cert-manager) and trust it on my systems, and issue certs for internal services from that.

Re: Ask HN: What's your solution for SSL on internal servers?

#14

Post by tyingq » Wed, Feb 09, 2022, 1:41 PM UTC

tqwhite wrote: post #6

For a long time I was all fussy about having to create a security exception for self-signed certificates. One day I realized I was acting insane, as if there was some glorious principle involved. There isn't. I trust my own (or coworkers) certificates. It's a dev site for heavens sake. Ever since, ssh-keygen all the way.

It can be tricky to get self-signed certificates put into all the various places where they need to be. OS level certificate stores, browsers, mobile devices, curl, python/requests, VPN clients, etc. There's always some weird exception case.

Re: Ask HN: What's your solution for SSL on internal servers?

#15

Post by perbu » Wed, Feb 09, 2022, 1:42 PM UTC

dindresto wrote: post #4

I'm using subdomains on a domain I own and request Let's Encrypt certificates with the DNS challenge.

Just beware that the records of the TLS certs are public. So you'll leak a some hostnames. This might or might not be ok.

Re: Ask HN: What's your solution for SSL on internal servers?

#16

Post by isthisfree » Wed, Feb 09, 2022, 1:42 PM UTC

If you can automate DNS, create a wildcard LE cert and have a cronjob to maintain it around your different places from the one place you issue it. That is what I do.

Before that I just bought one wildcard cert and used that. Can be bought at less than 50 bucks and then no hassle.

If I could not automate DNS and I don't have 50 bucks per year for it, I would create a small CA myself, trust it in my browsers and issue certificates from that.

Re: Ask HN: What's your solution for SSL on internal servers?

#17

Post by Cockbrand » Wed, Feb 09, 2022, 1:44 PM UTC

I have only one internal server which is coincidentally also accessible from the public Internet. I use NAT hairpinning for the external interface of my router and forward all packages on ports 22 and 443 to my server, so its TLS certificate is also valid from inside my LAN.

Re: Ask HN: What's your solution for SSL on internal servers?

#18

Post by dboreham » Wed, Feb 09, 2022, 1:45 PM UTC

savolai wrote: post #7

tqwhite wrote: post #6

For a long time I was all fussy about having to create a security exception for self-signed certificates. One day I realized I was acting insane, as if there was some glorious principle involved. There isn't. I trust my own (or coworkers) certificates. It's a dev site for heavens sake. Ever since, ssh-keygen all the way.

It appears to me the issue is browser warning dialogs that imply it is always very dangerous. There should be either more context explained in those dialogs or a recognition of/mode for sites that are supposed to be self signed.

There is a long history to this. The original browser warnings were along the lines of your suggestion. Then it was discovered that regular users just clicked through the warning when an attacker MITM'ed their bank. There followed decades of making the warning ever more scary sounding and ever more difficult to bypass.

Re: Ask HN: What's your solution for SSL on internal servers?

#19

Post by ThermalCube » Wed, Feb 09, 2022, 1:45 PM UTC

savolai wrote: post #7

tqwhite wrote: post #6

For a long time I was all fussy about having to create a security exception for self-signed certificates. One day I realized I was acting insane, as if there was some glorious principle involved. There isn't. I trust my own (or coworkers) certificates. It's a dev site for heavens sake. Ever since, ssh-keygen all the way.

It appears to me the issue is browser warning dialogs that imply it is always very dangerous. There should be either more context explained in those dialogs or a recognition of/mode for sites that are supposed to be self signed.

(Untested idea) I'd suggest creating your own Root CA with an expire-date far in the future. Install it's public key as a trusted certificate and all derived certificates should not prompt any issues anymore

Re: Ask HN: What's your solution for SSL on internal servers?

#20

Post by viovanov » Wed, Feb 09, 2022, 1:45 PM UTC

bryanlarsen wrote: post #12

viovanov wrote: post #8

Earlier quoted context omitted.

Then you're routing internal traffic through a public IP? Or do they support wildcard certs?

SSL certificates contain the name, not the IP. So the IP address can be anything, including internal ones.

I thought Let's Encrypt wouldn't give you a cert if the domain on the cert resolves to a private IP. Good to know - thx.