How do I use HTTPS on a private LAN without self-signed certs?

[offspec@lemmy.world]

With certbot there's probably a plugin to do it automatically, but if you just want to get something working right now you can run the following to manually run a dns challenge against your chosen domain names and get a cert for any specified. This will expire in ~3 months and you'll need to do it again, so I'd recommend throwing it in a cron job and finding the applicable certbot-dns-dnsprovider plugin that will make it run without your input. Once you have it working you can extract the certs from /etc/letsencrypt/live on most systems. Just be aware that the files there are going to be symlinks so you'll want to copy them before tarballing them to move other machines.

certbot --preferred-challenges dns --manual certonly -d *.mydomain.tld -d mydomain.tld -d *.local.mydomain.tld

[douglasg14b@lemmy.world]

I just:

1. Have my router setup with DNS for domains I want to direct locally, and point them to:
2. Have a reverse proxy that has auto- certbot behavior (caddy) connected to the cloud flair API
3. Navigation I do within my local network to these domains gives me real certificates.

[celestus@lemm.ee]

FYI, all the certs you generate are public record, so it might be a good idea to use a wildcard route in Caddy. That will make it only generates one cert, so no one can find your internal domain names. Especially if your Caddy instance is accessible from the Internet, and you’re expecting external connections not to be able to access domains with only internal DNS records

[monument@lemmy.sdf.org]

The advice I needed and have not been able to find. I could kiss you. Or at least give you a fond nod.

[lovablesidekick@lemmy.world]

When somebody says they "just" reverse the polarity of the navigational deflector array and channel power directly from the warp core.

[lodemike@lemmy.today]

Let's encrypt has a DNS verification option.

[false@lemmy.world]

You don't need a public DNS record for https to work. You can just use public external certs as long as it's for a domain you own. You don't need to setup the same domains externally.

If you want certs for a domain you own, then yeah you're looking at self signed.

[false@lemmy.world]

Running your own CA is essentially still a form of self signed. Though it will work better for some use cases (at the cost of more complexity)

[Guest]

I use Nginx and let's encrypt. Works super easily and auto updates.

[whyjiffie@sh.itjust.works]

browsers complain less, and some apps (like HomeAssistant Android) only accept that

[false@lemmy.world]

Trust the self signed cert. Works similarly to trusting a CA.

[whyjiffie@sh.itjust.works]

for every single subdomain, on desktop. firefox mobile does not even remember the decision. HA Android straight out refuses it, and thats not a local problem but a relatively known problem in the community

[false@lemmy.world]

Import it into the trust store in the browser/OS. It should be the same operation for a self-signed cert and a CA that isn't subordinate to the standard internet root CAs.

If you can't import your own root CA cert then you're probably screwed on both fronts and are going to have to use a public CA that's subordinate to a commonly trusted root CA.

[iantwenty@lemmy.world]

I know what you mean but using real self-signed certificates (i.e. no CA at all) with modern browsers causes so many issues I find them unusable.

[n0x0n@lemmy.ml]

Just create a wildcard domain certificate !

I access all my services in my lan through https://servicename.home.lab/ I just had to add the rootCA certificat (actually the intermediate certificate) into my trust store on every device. That's what they actually do, just in automated way !

Never had an issue to access my services with my self-signed certs, neither on Android, iOS, windows, linux ! Everything served from my server via my reverse proxy of choice (Treafik).

However I do remember that there was something of importance to make my Android device accept the certificate (something in certificate itself and the extension).

If you're interested I can send you the snipped of a book to fully host your own CA :). It's a great read and easy to follow !

[douglasg14b@lemmy.world]

That's a good call out.

There are a few things I do right now:

1. All of my public DNS entries for the certs point at cloudflare, not my IP.
2. My internal Network DNS resolver will resolve those domains to an internal address
3. I drop all connections to those domains in cloudflare with rules
4. In caddy, I drop all connections that come from a non-internal IP range for all internal services
5. I use tailscale to avoid having to have routes from the Internet into my internal services for when I'm not at home.
6. For externally accessible routes, I have entirely separate configurations that proxy access to them. And external DNS still points to cloudflare, which has very restrictive rules on allowable connections.

[douglasg14b@lemmy.world]

In this case I run pfSense instead of my ISP provided router. This allows me to have my own DNS resolver, which I can then resolve various domains to internal addresses.

All devices on my network point to my router for DNS allowing them to resolve internal addresses from all of these.

[reluctant_squidd@lemmy.ca]

Not sure if anyone else mentioned this, but you can just redirect traffic on your local LAN with an ad blocker like pihole ( I currently use adguardhome podman instance )

Basically, it rewrites any calls to your outside domain from within your local network, back to your local web server. As long as the site is setup with the certificate there, you’re good.

Then setup a Nina nginx reverse proxy and you’re golden. Regular site outside LAN, internal site inside LAN.

[lovablesidekick@lemmy.world]

Thanks, I'll lookup pfSense. But straightforward host mapping has worked for me in the past with this router and others. It worked great on my old Cisco DSL router 25 years ago. So simple and straightforward, it should just freaking work. sigh

[sugar_in_your_tea@sh.itjust.works]

I did basically this w/ Cloudflare, and it worked perfectly. I used to do ACME requests, but this is simpler and doesn't require me to route traffic into my LAN. I now expose a handful of services, but I used to have to expose all services for TLS cert renewal to work.