Earlier quoted context omitted.
I'm not familiar with this exact setup, but I am assuming you have full control over the router software, but want to limit any installation or configuration of either the browser's computer or the local network fileservers. > Subnet IPs are always different tho. Can I really get a cert for all subnet addresses? SSL certs don't usually have anything to do with the IP address, that is usually handled by the hosts file…
Correct. Probably can even configure local network file servers, but better if not. If we don't ever need to use domains in the mesh (we have a separate directory / search system). Wait, I only have to have the certs locally (offline) on the routers? Ahh, hmm, cause you're saying I could MITM it. But Browsers (especially on mobile) all usually freak out when they go to ` https://subnetIPaddress` saying "your connecti…
The router needs both the private key and a signed cert recent cert. Neither machine needs access to to the internet to validate the cert. The client uses it's preinstalled root certificate public keys to see if any of them signed the certificate provided by the server (any intermediate certs are also provided by the server).
The only online requirement is to have the clients recieve SOME non-local ip address in response to their initial DNS query for the domain (the specific IP address doesn't necissarily matter since the router will be intercepting the request before it is routed using that IP address)
You can get longer multi-year certs, but Let's Encrypt doesn't charge and allows you to script the automatic regeneration of new certs.