Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What's your solution for SSL on internal servers?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 79 posts

Re: Ask HN: What's your solution for SSL on internal servers?

#61

Post by fulafel »

viovanov wrote: post #8
dindresto wrote: post #4

I'm using subdomains on a domain I own and request Let's Encrypt certificates with the DNS challenge.

Then you're routing internal traffic through a public IP? Or do they support wildcard certs?

Other replies already explained how this is orthoginal to IP addressing, but also there's not many virtuous virtuous things and many downsides about using ambiguous addresses your server to server communications. Also invariably you'll eventually end up networking them in a new way you didn't originally plan. It ends up being bad for security because it breeds unneeded complexity and makes your system harder to understand.

Re: Ask HN: What's your solution for SSL on internal servers?

#63

Post by throwawayninja »

wolrah wrote: post #54
larcher wrote: post #38

Earlier quoted context omitted.

Friendly reminder that 1.1.1.1 is a real, valid, public IP. Seen plenty of networks that don’t recognize this, use it for some internal purpose, and break https://1.1.1.1/

> Seen plenty of networks that don’t recognize this, use it for some internal purpose, and break https://1.1.1.1/ AFAIK Cisco used 1.1.1.1 as an example "dummy" IP in their wireless LAN controller documentation, which of course led to infinite idiots copy/pasting exactly that and setting up broken networks.

My college uses 1.1.1.1 as their iis administration endpoint, I was told the reason was "nobody would guess it so it reduces the number of dumb kids guessing the edu\Administrator domain password". Around the time cloudflare started using it their logs must have skyrocketed.

Re: Ask HN: What's your solution for SSL on internal servers?

#64

Post by Macha »

tyingq wrote: post #27
viovanov wrote: post #8

Earlier quoted context omitted.

Then you're routing internal traffic through a public IP? Or do they support wildcard certs?

>Then you're routing internal traffic through a public IP? No, not typically. There's various methods to do the LetsEncrypt challenge/verification that don't require internet connecting the internal host you're generating the certificate for. The downsides are: - You can generate a wildcart cert for *.internal.yourdomain.tld. But then, it's a pretty big master key if you lose control of it. - You can generate a cert-…

> You can generate a wildcart cert for *.internal.yourdomain.tld. But then, it's a pretty big master key if you lose control of it.

For a home network, this is less relevant, since many of the services (and the nginx gateway) are running on the same host as the cert resides on. If they grab the wildcard cert, they're already in a position to mess with the services directly, no SSL MITM needed

Re: Ask HN: What's your solution for SSL on internal servers?

#65

Post by throw0101a »

DNS alias mode:

* https://dan.langille.org/2019/02/01/acme-domain-alias-mode/

* https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo...

* https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...

You want the name "internal.example.com". In your external DNS you create a CNAME from "_acme-challenge.internal.example.com" and point it to (e.g.) "internal.example.net" or "internal.dns-auth.example.com"

When you request the certificate you specify the "dns-01" method. The issuer (e.g., LE) will go to the the external DNS server for the look up, see that it is a CNAME and then follow the CNAME/alias, and do the verification at the final hostname.

So your ACME client has to do a DNS (TXT) record update, which can often be done via various APIs, e.g.:

* https://github.com/AnalogJ/lexicon

You can even run your own DNS server locally (in a DMZ?) if your DNS provider does not have an convenient API. There are servers written for this use case:

* https://github.com/joohoi/acme-dns

* https://github.com/joohoi/acme-dns-certbot-joohoi

* https://github.com/pawitp/acme-dns-server

Re: Ask HN: What's your solution for SSL on internal servers?

#66

Post by ganondork »

I do a lot of the same things as others with a custom domain at home with a NAT 80/443 forward to nginx, but I use https://nginxproxymanager.com/ as it gives a dead-simple hostname proxy to forward traffic to internal hosts, and will request/renew Let's Encrypt certs for them automatically.

Re: Ask HN: What's your solution for SSL on internal servers?

#70

Post by AnonHP »

api wrote: post #39

At ZeroTier we are working on a solution for this that will implement ACME. Not ready for release quite yet but getting close. Could be used on ZeroTier networks but doesn't have to be.

Please post a submission on HN whenever this is released.
Post reply on HN