Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TLS certificates for internal services done right

tuxnet.dev

Post reply on HN
Print view View original

161–170 of 177 posts

Re: TLS certificates for internal services done right

#161

Post by ivlad »

stock_toaster wrote: post #51
EvanAnderson wrote: post #14

The relative proximity of the words "done right" and "split-horizon DNS" makes my insides hurt a little bit. Use DNS validation to allow these internal services to pull ACME certs. There's so much less headache, long-term. Split-horizon DNS (and the tedious make-work it can create when you start needing to mirror public-accessibly records in the private DNS) has always been something to aspire to move away from in my…

Once dns-persist-01 becomes available/usable[1], it should make dns validation even easier. [1]: https://letsencrypt.org/2026/02/18/dns-persist-01

Or, just use IPv6 and host Internet services in a routable address. Then, use ACLs at web server / proxy / L7 lb level to allow acme-challenge unauthenticated but everything else authenticated.

Lets encrypt supports IPv6 for validation.

Re: TLS certificates for internal services done right

#163

Post by graton »

tzs wrote: post #94
graton wrote: post #48

Earlier quoted context omitted.

I do the same thing. I'm not worried about them seeing my FQDNs. I use the form of hostname.int.example.com for everything inside my home network. None of which is accessible to the outside world. I use LetsEncrypt with DNS validation to get the certificates.

If you are going to have all the home stuff on a subdomain (int.example.com) would it work to delegate int.example.com to a DNS server running at home what has internet access, and could handle the ACME DNS challenges for machines on int.example.com? If it does then you don't have to mess with your public DNS whenever you want to add or renew certificates for home machines. I'm using the free DNS my registrar provide…

> I'm using the free DNS my registrar provides, which doesn't provide API access unless you upgrade to their paid DNS service

I use Cloudflare for DNS and it is free to use the API.

Re: TLS certificates for internal services done right

#164

Post by [deleted] »

zeeZ wrote: post #152
xg15 wrote: post #147

Earlier quoted context omitted.

At this point, can't we make a standard that skips the middlemen and just embeds the certificate directly inside the DNS entry? It seems the challenge system is converging towards that anyway.

That would be DANE with TLSA (RFC 6698, not the stock ticker symbol). You've still got just another chain of trust with the DNSSEC requirement, and the recent DENIC outage breaking that for the entirety of .de isn't the greatest advertisement :D

[deleted]

Re: TLS certificates for internal services done right

#165

Post by xg15 »

zeeZ wrote: post #152
xg15 wrote: post #147

Earlier quoted context omitted.

At this point, can't we make a standard that skips the middlemen and just embeds the certificate directly inside the DNS entry? It seems the challenge system is converging towards that anyway.

That would be DANE with TLSA (RFC 6698, not the stock ticker symbol). You've still got just another chain of trust with the DNSSEC requirement, and the recent DENIC outage breaking that for the entirety of .de isn't the greatest advertisement :D

(To explain that some more: The current "way to go" with fully automated cert issuance is delegating its trust to DNS anyway - so we might as well get rid of CAs and use the DNSSEC chain of trust directly, with TLS certs linked to it.)

Re: TLS certificates for internal services done right

#166

Post by raffraffraff »

rao-v wrote: post #63
raffraffraff wrote: post #25

Hmm. I don't really care enough about leaking home network host names because they are all super generic names like 'router', 'laptop', 'tv', 'nas'. So I use my public zone on cloudflare. I just use internal ip addresses (eg: nas.example.com = 10.1.2.3) on the public zone and DNS01 challenge for let's encrypt. Anyone can resolve the ip for any of my hosts, but obviously you'd need to be on the wireguard vpn to hit th…

At that point why not just use the .ts.net addresses Tailscale provides for free?

I get to use the same host names and IP addresses at home or on the VPN. I run a simple wireguard server on a Raspberry pi, and the whole setup has been rock solid.

I did set up tailscale, way back. After using it a few times to test, it failed me when I really needed it (I was out of the country and it failed - can't remember exactly what went wrong but it wwas 100% 'in my tailscale account'). I immediately dropped it and went back to OpenVPN (shit but reliable) before building my current setup.

Re: TLS certificates for internal services done right

#167

Post by TAlborough »

tptacek wrote: post #154
zeeZ wrote: post #152

Earlier quoted context omitted.

That would be DANE with TLSA (RFC 6698, not the stock ticker symbol). You've still got just another chain of trust with the DNSSEC requirement, and the recent DENIC outage breaking that for the entirety of .de isn't the greatest advertisement :D

It's also a dead letter: browsers won't implement it (they did at one point, and then withdrew it).

[flagged]

Re: TLS certificates for internal services done right

#168

Post by JoeBOFH »

selfmodruntime wrote: post #143
JoeBOFH wrote: post #66

Earlier quoted context omitted.

And you still have issues sometimes around dns not able to figure out which interface to use. We had issues around that before.

Yes! That is our exact issue. Do you have any idea on how to circumvent this problem?

Our issue was on multiple fronts. On windows it was GlobalProtect overriding dns requests. On Linux it was an issue with the OS fighting which nameservers to use. The fix was some experimental flag, tho I can’t remember it currently.

Re: TLS certificates for internal services done right

#169

Post by master_crab »

Walf wrote: post #160
master_crab wrote: post #127

Earlier quoted context omitted.

Wait…what? You have a fully internal service and you dont have an internal DNS server? I guess those exist in theory, but not in practice. :) If you have a heavy enough tech stack to run fully internal services, than you can also run an internal DNS service (even pihole is enough) and load internal only entries there. Or add everything to your hosts file if you have a central config service.

What, indeed. Yes, I have internal DNS servers. They are what handle the split horizons. How would one do split horizon without an internal DNS service?

You don’t. You avoid split horizon because of the silent (usually failure) mechanics it introduces.

Re: TLS certificates for internal services done right

#170

Post by Walf »

master_crab wrote: post #169
Walf wrote: post #160

Earlier quoted context omitted.

What, indeed. Yes, I have internal DNS servers. They are what handle the split horizons. How would one do split horizon without an internal DNS service?

You don’t. You avoid split horizon because of the silent (usually failure) mechanics it introduces.

I wasn't talking about your opinion of it, I was simply using a rhetorical question to point out the nonsensical premise of your response:

>Wait…what? You have a fully internal service and you dont have an internal DNS server?

You can't do split horizon without an internal DNS service. By definition it's a non-public service that gives separate results to public.

Post reply on HN