Banish OEM self-signed certs forever and roll your own private LetsEncrypt

Re:Banish OEM self-signed certs forever and roll your own pr... by globular-toast on Friday March 15, 2024 @07:45AM (#39714445)

This could be an interesting learning opportunity. But for the love of god, I hope nobody copies this parrot-fashion just to get rid of the browser warnings. There is no reason to use HTTPS on your LAN. Save yourself the effort and just don't do it.

[ Parent | on HN ]

Re:Banish OEM self-signed certs forever and roll your own pr... by noirscape on Friday March 15, 2024 @08:28AM (#39714771)

To be more exact, it's far easier to just shell out the cash for a domain name (or get a free subdomain from somewhere) and then just map the DNS on that domain to your internal infrastructure. That way you can just use letsencrypt certs without any hassle.

If you don't want to expose network details, use something like Tailscale to get unique internal IPs and map those. (Don't use Tailscale's own MagicDNS, that one logs individual certificates for machines into CT rather than giving you a wildcard cert for your tailnet).

[ Parent | on HN ]

Re:Banish OEM self-signed certs forever and roll your own pr... by globular-toast on Friday March 15, 2024 @09:52AM (#39715472)

Then you'll need a server running locally and the firewall rules to expose that to the internet and either a static IP address or some dynamic DNS client running.

No, I think it's far easier to just not do it.

[ Parent | on HN ]

Re:Banish OEM self-signed certs forever and roll your own pr... by noirscape on Friday March 15, 2024 @11:22AM (#39716767)

You don't; DNS-01 doesn't require contacting any servers besides the DNS registrar, which is what makes it so nice.

In practice, most domain registrars have certbot plugins - you just grab your API key from their customer portal and put it in a file, then run certbot in DNS-01 mode and instruct them to use that. Certbot places a temporary TXT record, which gets verified and the certificate is issued. Then certbot removes the TXT record and that's that. If there's no plugin, you do that by hand, which works but is a bit more involved.

You don't need a firewall for that or a DDNS client. Also if you have a weird registrar that only offers you to set NS records, most VPS providers have free DNS services.

[ Parent | on HN ]

Re:Banish OEM self-signed certs forever and roll your own pr... by guipsp on Friday March 15, 2024 @11:07AM (#39716604)

No, not really. You can obtain the certificate externally and use it internally. The DNS challenge type does not require a web server exposed externally either.

Sure, it's far easier not to do it. It's also far easier to have no root password.

[ Parent | on HN ]

Re:Banish OEM self-signed certs forever and roll your own pr... by jasode on Friday March 15, 2024 @08:10AM (#39714659)

>There is no reason to use HTTPS on your LAN. Save yourself the effort and just don't do it.

SSL https is definitely a hassle with private home networks but there can be reasons for it.

For example, self-hosted Bitwarden/Vaultwarden password manager doesn't work without https:// SSL.

The client UI for managing passwords running in web browsers depend on the Chrome/Firefox cryptography APIs and those don't work for non-encrypted http:// :

>Access to the WebCrypto API is restricted to secure origins (which is to say https:// pages). -- from https://www.chromium.org/blink/webcrypto/#:~:text=Access%20t....

[ Parent | on HN ]

Re:Banish OEM self-signed certs forever and roll your own pr... by gregfagan on Friday March 15, 2024 @08:08AM (#39714636)

Unless you’re building a web app that requires a secure context.

https://developer.mozilla.org/en-US/docs/Web/Security/Secure...

[ Parent | on HN ]

Re:Banish OEM self-signed certs forever and roll your own pr... by Already__Taken on Friday March 15, 2024 @09:39AM (#39715345)

yeh secure by default isn't harder than dealing with every edge case and quirk.

[ Parent | on HN ]

Re:Banish OEM self-signed certs forever and roll your own pr... by globular-toast on Friday March 15, 2024 @09:53AM (#39715492)

Browsers support *.localhost as a secure context.

[ Parent | on HN ]

Re:Banish OEM self-signed certs forever and roll your own pr... by Arch-TK on Friday March 15, 2024 @07:47AM (#39714464)

ZTA is fun to experiment with in your home LAN. And to be fair, most people's networks could benefit from it. That being said, the recommendation in this post is not for proper ZTA.

[ Parent | on HN ]