How do I use HTTPS on a private LAN without self-signed certs?

Submitted ⁨⁨3⁩ ⁨weeks⁩ ago⁩ by ⁨early_riser@lemmy.radio⁩ to ⁨selfhosted@lemmy.world⁩

Maybe this is more of a home lab question, but I’m utterly clueless regarding PKI and HTTPS certs, despite taking more than one class that goes into some detail about how the system works. I’ve tried finding guides on how to set up your own CA, but my eyes glaze over after the third or fourth certificate you have to generate.

Anyway, I know you need a public DNS record for HTTPS to work, and it struck me recently that I do in fact own a domain name that I currently use as my DNS suffix on my LAN. Is there a way I can get Let’s Encrypt to dole out a wildcard certificate I can use on the hosts in my LAN so I don’t have to fiddle with every machine that uses every service I’m hosting? If so, is there a guide for the brain dead one could point me to? Maybe doing this will help me grock the whole PKI thing.

source

Comments

Sort:hotnew top

mouse@midwest.social ⁨3⁩ ⁨weeks⁩ ago
I use Caddy for this. I’ll leave links to the documentation as well as a few examples.

Here’s the documentation for wildcard certs. caddyserver.com/docs/automatic-https#wildcard-cer…

Here’s how you add DNS providers to Caddy without Docker. caddy.community/t/…/8148

Here’s how you do it with Docker. github.com/docker-library/docs/tree/master/caddy#…

Look for the DNS provider in this repository first. github.com/caddy-dns

Here’s documentation about using environment variables. caddyserver.com/docs/caddyfile/concepts#environme…

Docker

A few examples of Dockerfiles. These will build Caddy with DNS support.

DuckDNS

FROM caddy:2-builder AS builder RUN xcaddy build --with github.com/caddy-dns/duckdns FROM caddy:2 COPY --from=builder /usr/bin/caddy /usr/bin/caddy

Cloudflare

FROM caddy:2-builder AS builder RUN xcaddy build --with github.com/caddy-dns/cloudflare FROM caddy:2 COPY --from=builder /usr/bin/caddy /usr/bin/caddy

Porkbun

FROM caddy:2-builder AS builder RUN xcaddy build --with github.com/caddy-dns/porkbun FROM caddy:2 COPY --from=builder /usr/bin/caddy /usr/bin/caddy

Configure DNS provider

This is what to add the the Caddyfile, I’ve used these in the examples that follow this section. You can look at the repository for the DNS provider to see how to configure it for example.

DuckDNS

github.com/caddy-dns/cloudflare?tab=readme-ov-fil…

tls { dns duckdns {env.DUCKDNS_API_TOKEN} }

CloudFlare

github.com/caddy-dns/cloudflare?tab=readme-ov-fil… Dual-key

tls { dns cloudflare { zone_token {env.CF_ZONE_TOKEN} api_token {env.CF_API_TOKEN} } }

Single-key

tls { dns cloudflare {env.CF_API_TOKEN} }

PorkBun

github.com/caddy-dns/porkbun?tab=readme-ov-file#c… Global

{ acme_dns porkbun { api_key {env.PORKBUN_API_KEY} api_secret_key {env.PORKBUN_API_SECRET_KEY} } }

or per site

tls { dns porkbun { api_key {env.PORKBUN_API_KEY} api_secret_key {env.PORKBUN_API_SECRET_KEY} } }

Caddyfile

And finally the Caddyfile examples.

DuckDNS

Here’s how you do it with DuckDNS.

*.example.org { tls { dns duckdns {$DUCKDNS_TOKEN} } @hass host home-assistant.example.org handle @hass { reverse_proxy home-assistant:8123 } }

Also you can use environment variables like this.

*.{$DOMAIN} { tls { dns duckdns {$DUCKDNS_TOKEN} } @hass host home-assistant.{$DOMAIN} handle @hass { reverse_proxy home-assistant:8123 } }

CloudFlare.

*.{$DOMAIN} { tls { dns cloudflare {env.CF_API_TOKEN} } @hass host home-assistant.{$DOMAIN} handle @hass { reverse_proxy home-assistant:8123 } }

Porkbun

*.{$DOMAIN} { tls { dns porkbun { api_key {env.PORKBUN_API_KEY} api_secret_key {env.PORKBUN_API_SECRET_KEY} } } @hass host home-assistant.{$DOMAIN} handle @hass { reverse_proxy home-assistant:8123 } }
source
- eneff@discuss.tchncs.de ⁨3⁩ ⁨weeks⁩ ago
  thank you for providing such a thorough reply, good shit
  
  source
- theparadox@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  Thanks for being so detailed!
  
  I use caddy for straightforward https, but every time I try to use it for a service that isn’t just a reverse_proxy entry, I really struggle to find resources I understand… and most of the time the “solutions” I find are outdated and don’t seem to work. The most recent example of this for me would be Baikal.
  
  Do you have any recommendations for where I might get good examples and learn more about how do troubleshoot and improve my Caddyfile entries?
  
  Thanks!
  
  source
  - sugar_in_your_tea@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago
    
    Baikal
    
    Ah, PHP, there’s your problem. 😀
    
    Honestly, I just proxy to a separate nginx server to handle the PHP bits, it’s not worth cluttering up my nice, clean Caddy setup with that nonsense.
    
    source
  - mouse@midwest.social ⁨3⁩ ⁨weeks⁩ ago
    Unfortunately that’s one area I am bad with, I tend to use reverse_proxy for most such as Baikal running with the ckulka/baikal Docker image (which runs Nginx or Apache), otherwise I only static sites.
    
    I’d start by looking at Baikal’s config for Apache and Nginx, sabre.io/baikal/install/ and comparing to the directives for Caddy, caddyserver.com/docs/caddyfile/directives and
    
    Since it uses PHP, it will need that, caddyserver.com/docs/caddyfile/patterns#php
    
    Upon my searches I came across this, it talks about running Baikal with Caddy specifically. github.com/caddyserver/caddy/issues/497
    
    I hope that this provided some helpful directions.
    
    source
- conrad82@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  I do the same!
  
  I have a provider that is not supported by caddy, but I can still use it via duckdns delegation!
  
  github.com/caddy-dns/duckdns?tab=readme-ov-file#c…
  
  Challenge delegation
  
  To obtain a certificate using ACME DNS challenges, you’d use this module as described above. But, if you have a different domain (say, my.example.com) CNAME’d to your Duck DNS domain, you have two options:
  
  Not use this module: Use a module matching the DNS provider for my.example.com.
  
  Delegate the challenge to Duck DNS.
  
  source
- sugar_in_your_tea@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago
  I did basically this w/ Cloudflare, and it worked perfectly. I used to do ACME requests, but this is simpler and doesn’t require me to route traffic into my LAN. I now expose a handful of services, but I used to have to expose all services for TLS cert renewal to work.
  
  source
- Monument@lemmy.sdf.org ⁨3⁩ ⁨weeks⁩ ago
  The advice I needed and have not been able to find. I could kiss you. Or at least give you a fond nod.
  
  source
xrun_detected@programming.dev ⁨3⁩ ⁨weeks⁩ ago
+1 for the letsencrypt wildcard with DNS verification, been using this for years. with dehydrated (github.com/dehydrated-io/dehydrated) you can automate renewing the certs, pretty convenient.

One thing i didn’t see mentioned yet - you can also easily create a wildcard for a subdomain of your domain, e.g. *.local.example.com. Most DNS providers let you define something like _acme-challenge.local IN TXT … so you don’t even need to define an extra zone for local.example.com. Probably makes no big difference, but i like it ^^

source
- 4am@lemm.ee ⁨3⁩ ⁨weeks⁩ ago
  If you are really looking for hassle-free this is it. LetsEncrypt root certificates are already trusted by most devices so when your friends come over and wanna control the media library or whatever you don’t need to install your locally hosted CA’s self-signed certificates on their phone.
  
  Also certbot and a cron or systemd timer is all you need; people have rolled all these fancy solutions but I say keep it simple.
  
  source
  - sem@lemmy.blahaj.zone ⁨3⁩ ⁨weeks⁩ ago
    Adding to this, the eff certbot website has really great noob-friendly instructions which really helped me get set up.
    
    source
Bzdalderon@lemmy.ca ⁨3⁩ ⁨weeks⁩ ago
I use Nginx and let’s encrypt. Works super easily and auto updates.

source
TedZanzibar@feddit.uk ⁨3⁩ ⁨weeks⁩ ago
If you own a domain, which you do, you can get wildcard certs from Let’s Encrypt using a DNS challenge. Most (all?) popular reverse proxies can do this either natively or via an addon/module, you just need to use a supported DNS provider.

source
IanTwenty@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
I’ll mention this as no one has yet but you can be your own CA. Tools like mkcert make it easy

github.com/FiloSottile/mkcert

This is potentially more hassle (than using public DNS) as you have to get your CA certs onto every device. However it may be suitable depending on the situation.

source
- False@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  Running your own CA is essentially still a form of self signed. Though it will work better for some use cases (at the cost of more complexity)
  
  source
  - WhyJiffie@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago
    browsers complain less, and some apps (like HomeAssistant Android) only accept that
    
    source
    -> View More Comments
  - IanTwenty@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
    I know what you mean but using real self-signed certificates (i.e. no CA at all) with modern browsers causes so many issues I find them unusable.
    
    source
catloaf@lemm.ee ⁨3⁩ ⁨weeks⁩ ago
You don’t need public DNS. You can use whatever domain you want if you use your own DNS server (though you should use one you own, or something under the .internal TLD).

Likewise, you can issue whatever certs you want if you trust the CA.

But LE does support wildcard certs. You can get them with certbot or other tools.

Personally I use traefik, which has LE support built in. It automatically gets an individual cert for each service. If you use caddy, I’m sure it has something similar.

source
False@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
You don’t need a public DNS record for https to work. You can just use public external certs as long as it’s for a domain you own. You don’t need to setup the same domains externally.

If you want certs for a domain you own, then yeah you’re looking at self signed.

source
JakenVeina@lemm.ee ⁨3⁩ ⁨weeks⁩ ago
The most straightforward thing to do, on a private LAN, is to make all your own certs, from a custom root cert, and then manually install that cert as “trusted” on each machine. If none of the machines on this network need to accessed from outside the LAN, then you’re golden.

source
bravesilvernest@lemmy.ml ⁨3⁩ ⁨weeks⁩ ago
I have a script to self-sign 10 year certs on internal traffic only, and then added my public cert to devices needing it. I’m going to be really annoyed in a decade, but until then I’m having a ball 🙂

source
douglasg14b@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
I just:

Have my router setup with DNS for domains I want to direct locally, and point them to:

Have a reverse proxy that has auto- certbot behavior (caddy) connected to the cloud flair API

Navigation I do within my local network to these domains gives me real certificates.
source
- LovableSidekick@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
  When somebody says they “just” reverse the polarity of the navigational deflector array and channel power directly from the warp core.
  
  source
  - douglasg14b@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
    In this case I run pfSense instead of my ISP provided router. This allows me to have my own DNS resolver, which I can then resolve various domains to internal addresses.
    
    All devices on my network point to my router for DNS allowing them to resolve internal addresses from all of these.
    
    source
    -> View More Comments
- Celestus@lemm.ee ⁨3⁩ ⁨weeks⁩ ago
  FYI, all the certs you generate are public record, so it might be a good idea to use a wildcard route in Caddy. That will make it only generates one cert, so no one can find your internal domain names. Especially if your Caddy instance is accessible from the Internet, and you’re expecting external connections not to be able to access domains with only internal DNS records
  
  source
  - douglasg14b@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
    That’s a good call out.
    
    There are a few things I do right now:
    
    All of my public DNS entries for the certs point at cloudflare, not my IP.
    
    My internal Network DNS resolver will resolve those domains to an internal address
    
    I drop all connections to those domains in cloudflare with rules
    
    In caddy, I drop all connections that come from a non-internal IP range for all internal services
    
    I use tailscale to avoid having to have routes from the Internet into my internal services for when I’m not at home.
    
    For externally accessible routes, I have entirely separate configurations that proxy access to them. And external DNS still points to cloudflare, which has very restrictive rules on allowable connections.
    
    source
reluctant_squidd@lemmy.ca ⁨3⁩ ⁨weeks⁩ ago
Not sure if anyone else mentioned this, but you can just redirect traffic on your local LAN with an ad blocker like pihole ( I currently use adguardhome podman instance )

Basically, it rewrites any calls to your outside domain from within your local network, back to your local web server. As long as the site is setup with the certificate there, you’re good.

Then setup a Nina nginx reverse proxy and you’re golden. Regular site outside LAN, internal site inside LAN.

source
LodeMike@lemmy.today ⁨3⁩ ⁨weeks⁩ ago
Let’s encrypt has a DNS verification option.

source
MangoPenguin@lemmy.blahaj.zone ⁨3⁩ ⁨weeks⁩ ago
LetsEncrypt.

source
suicidaleggroll@lemm.ee ⁨3⁩ ⁨weeks⁩ ago
Reverse proxy + DNS-challenge wildcard cert for your domain. The end. Super easy to set up and zero maintenance. Adding a new service is just a couple clicks in your reverse proxy and you’re done.

source
ZebraGoose@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago
I did follow this guide from Techno Tim, he uses cloudflare but you can go with Lets encrypt aswell

www.youtube.com/watch?v=liV3c9m_OX8

source
towerful@programming.dev ⁨3⁩ ⁨weeks⁩ ago
You need to control a domain, so LE can verify you are the controller of the domain, then LE will issue you a certificate saying you are the controller of the domain.

For a wildcard LE cert, you need to use the DNS challenge method.
Essentially the ACME client (or certbot or whatever) will talk to LE and say “I want a DNS challenge for *.example.com”.
LE will reply “ok, your order number 69, and your challenge code is DEADBEEF”.
ACME then interacts with your public nameserver (or you have to do this manually) and add the challenge code as a txt record _acme-challenge.example.com. (I’ve been caught out by the fact LE uses Google DNS for resolution, and Google will only follow 1 level of NS records from the root authorative nameserver).
All the while, LE is checking for that record. When it finds the record, it mints a wildcard certificate.
ACME then periodically checks in with LE asking for order 69. Once LE has minted the cert, it will return it to acme.
And now you have a wildcard cert.

So, how to use it on a local domain?
Use a split horizon DNS method.
Ensure your DHCP is handing out a local DNS for resolving.
Configure that local DNS to then use 8.8.8.8 or whatever as it’s upstream.
Then load in static/override records to the local DNS.
Pihole can do this. OPNSense/pfSense can do this. Unifi can do some of this.

How does this work?
Any device on your network that wants to know the IP of example.example.com will ask it’s configured DNS - the local DNS that you have configured.
The local DNS will check it’s static assignments and go “yeh, example.example.com is 10.10.3.3”.
If you ask you local DNS for google.com, it won’t have a static assignment for it, so it will ask it’s upstream DNS, and return that result.
And it means you aren’t putting private IP spaces on public NS records.

Then you can load in your wildcard cert to 10.10.3.3, and you will have a trusted HTTPS connection.

Here is a list of LE clients that will automate LE certs.
letsencrypt.org/docs/client-options/

Have a read through and pick your desired flavour.
Dig into the docs of that flavour, and start playing around.

If it’s all HTTPS, consider using something like Nginx Proxy Manager (nginxproxymanager.com) as a reverse proxy in front of your services and for managing the LE cert.
It’s super easy to use, has a decent GUI, and then it’s only 1 IP to point all DNS records to.

source
CapitalNumbers@lemm.ee ⁨2⁩ ⁨weeks⁩ ago
why would you realistically need HTTPS on your local network?

source
- early_riser@lemmy.radio ⁨2⁩ ⁨weeks⁩ ago
  At the time of the OP I was testing federating two nodeBB instances. ActivityPub requires HTTPS AFAIK.
  
  source
const_void@lemmy.ml ⁨3⁩ ⁨weeks⁩ ago
HAProxy + Cloudflare

source
offspec@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
With certbot there’s probably a plugin to do it automatically, but if you just want to get something working right now you can run the following to manually run a dns challenge against your chosen domain names and get a cert for any specified. This will expire in ~3 months and you’ll need to do it again, so I’d recommend throwing it in a cron job and finding the applicable certbot-dns-dnsprovider plugin that will make it run without your input. Once you have it working you can extract the certs from /etc/letsencrypt/live on most systems. Just be aware that the files there are going to be symlinks so you’ll want to copy them before tarballing them to move other machines.

certbot --preferred-challenges dns --manual certonly -d *.mydomain.tld -d mydomain.tld -d *.local.mydomain.tld

source
Lemmchen@feddit.org ⁨3⁩ ⁨weeks⁩ ago
Some form of domain and a DNS server (router or Pi-Hole) in your LAN

source
bedlam@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
I’m not sure about wildcard certs but I use this container to dole out letsencrypt certs for web services and it’s fairly straightforward compared to traefik or something: github.com/lucaslorentz/caddy-docker-proxy

Caddy docs: caddyserver.com/docs/quick-starts/reverse-proxy

source
fmstrat@lemmy.nowsci.com ⁨2⁩ ⁨weeks⁩ ago
I used to do what you do, just sub-domains for everything. I eventually set up an internal CA for *.lan and install the CA cert on all devices.

It’s actually more secure, since I dont rely on a third-party for certs and have full control over pinning.

source
StrawberryPigtails@lemmy.sdf.org ⁨3⁩ ⁨weeks⁩ ago
I’ve never done it myself but this may be what you’re looking for.

source
neon_nova@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago
I wish you luck on this. I also would like to learn more about this, but it’s not a priority for me. I just got a cheap vps and will use that for testing 😂

source

How do I use HTTPS on a private LAN without self-signed certs?

Comments

Docker

DuckDNS

Cloudflare

Porkbun

Configure DNS provider

DuckDNS

CloudFlare

PorkBun

Caddyfile

DuckDNS

CloudFlare.

Porkbun

Challenge delegation