Easy HTTPS for your private networks
Easy HTTPS for your private networks
getlocalcert helps you manage HTTPS on private, local, and internal networks with free subdomains
This webpage provides instructions for using the acme-dns DNS challenge method with various ACME clients to obtain HTTPS certificates for private networks. Caddy, Traefik, cert-manager, acme.sh, LEGO and Certify The Web are listed as ACME clients that support acme-dns. For each client, configuration examples are provided that show how to set API credentials and other settings to use the acme-dns service at https://api.getlocalcert.net/api/v1/acme-dns-compat to obtain certificates. Interesting that so many ACME clients support the acme-dns service, providing an easy way to obtain HTTPS certificates for private networks.
HN https://news.ycombinator.com/item?id=36674224
seiferteric: Proposes an idea for automatically creating trusted certificates for new devices on a private network.
hartmel: Mentions SCEP which allows automatic certificate enrollment for network devices.
mananaysiempre: Thinks using EJBCA for this, as hartmel suggested, adds unnecessary complexity.
8organicbits: Describes a solution using getlocalcert which issues certificates for anonymous domain names.
austin-cheney: Has a solution using TypeScript that checks for existing certificates and creates them if needed, installing them in the OS and browser.
bruce511: Says automating the process is possible.
lolinder: Mentions Caddy will automatically create and manage certificates for local domains.
frfl: Uses Lego to get a Let's Encrypt certificate for a local network website using the DNS challenge.
donselaar: Recommends DANE which works well for private networks without a public CA, but lacks browser support.
Big fan of letsencrypt’s certbot with the nginx and cloudflare (or other dns providers) plugins.
Is there any reason to use caddy or traefik over nginx?
I found traefik to be a more feature rich, load balancer when used in kubernetes environments. Other than use in kubernetes, I'd say if you're happy with nginx, keep using nginx :)
Personally I use dnsrobocert with my own domains. I've got a few subdomains that point to a Wireguard subnet IP for private network apps (so it resolves to nothing if you're not on VPN). Having a real valid SSL cert is really nice vs self signing, and it keeps my browser with HTTPS-Everywhere happy.
Yep, caddy was as easy as to use xcaddy with the module of my DNS, configure the key and run caddy, that's it xD.
For what lolinder mentioned in the news link you need to have port 80 open.
If you don't want that you could configure local authority, but that'll give the warning of a selfsigned certificate.Personally I use dnsrobocert with my own domains. I've got a few subdomains that point to a Wireguard subnet IP for private network apps (so it resolves to nothing if you're not on VPN). Having a real valid SSL cert is really nice vs self signing, and it keeps my browser with HTTPS-Everywhere happy.
All you need is a certificate, Let's Encrypt will give you the cert for free, all you gotta do is set up the port.
Not like this is SSL or anything.
IMHO all these approaches are convoluted and introduce way too many components (SPOFs) to solve the problem. They're "free" but they come at the cost of maintaining all this extra infrastructure and don't forget that certificate transparency logs mean all your internal DNS records that you request a LetsEncrypt certificate for will be published publicly. (!)
An alternative approach is to set up your own internal certificate authority (CA), which you can do in a couple minutes with step-ca. You then just deploy your CA root cert to all the machines on your network and can get certs whenever you need. If you want to go the extra mile and set up automatic renewal, you can do that too, but it's overkill for internal use IMHO.
Using your own CA introduces only a single new software component and it doesn't require high availability to be useful....