In theory you could generate a wildcard to a domain then use it.
Comment on Certbot is great. Let's Encrypt is great.
steltek@lemm.ee 1 year ago
I’m obviously a fan of LE but a simple self-hosted option with a custom CA would be great for local machines:
- I don’t want every Raspberry Pi/laptop/temp VM/whatever published into the cert transparency record
- Configuring the router to forward every local hostname to the machine’s .well-known would be awful (if my ISP even allowed port 80)
- Exposing local machines to the Internet is an unnecessary degradation of security
csm10495@sh.itjust.works 1 year ago
SirNuke@kbin.social 1 year ago
It's easy* to setup Hashicorp Vault with your own CA and do automated cert generation and rotation, if you are willing to integrate everything into Vault and install your root CA everywhere. (*not really harder than any other Vault setup, but yaknow). I may go down this route eventually since I don't think a device I don't control has ever accessed anything I selfhost, or ever will.
I have a wildcard subdomain pointing to my public IP, and forward port 80 to an LXC container with certbot. Port 80 appears closed outside the brief window when certbot is renewing certs. Inside my network I have my PiHole configured to return the local IP for each service.
Nothing exposed to the internet at all. There is a record of my hostnames on Let's Encrypt but not concerned if someone will, say, deduce apollo-idrac is the iDRAC service for a Dell rackmount server called apollo and the other Greek/Roman gods are VMs on it. Seemed like a house of cards that would never work reliably, but three odd years later I only have issues if a DNS resolver insists on bypassing my PiHole. And that DNS resolver is SystemD-ResolveD which should crawl back into whatever hellhole it came out of.
thirdBreakfast@lemmy.world 1 year ago
My use case is for domains hosted on a VPS rather than my home server-hosted stuff. None of that is exposed to the internet except via Tailnet. I’ve got a domain saved up for that but haven’t figured it out how to do it since the CA can’t access my server to verify it. I have the feeling the answer is going to be ten more commenters telling me to check out Caddy.
TheButtonJustSpins@infosec.pub 1 year ago
Use DNS verification and wildcard certs and all this goes away.
dan@upvote.au 1 year ago
+1
I use acme-dns and it works very well. It’s a basic DNS server that only serves the Let’s Encrypt DNS challenges - it only allows clients to create TXT records, in the exact format that Let’s Encrypt needs. This is great for security as you don’t have to give Certbot/whatever full access to your main DNS servers.
Let’s Encrypt is fine with IPv6-only DNS servers, so I have acme-dns running on one of my VPSes only over IPv6 (since I’m using the IPv4 for my regular DNS server).
skankhunt42@lemmy.ca 1 year ago
This… Is what I’ve wanted but never looked up if it was possible. Thank you. I’ve been manually renewing my cert for ages…