Re:Banish OEM self-signed certs forever and roll your own pr...
by globular-toast on Friday March 15, 2024 @09:52AM
(#39715472)
Then you'll need a server running locally and the firewall rules to expose that to the internet and either a static IP address or some dynamic DNS client running.
No, I think it's far easier to just not do it.
Re:Banish OEM self-signed certs forever and roll your own pr...
by noirscape on Friday March 15, 2024 @11:22AM
(#39716767)
You don't; DNS-01 doesn't require contacting any servers besides the DNS registrar, which is what makes it so nice.
In practice, most domain registrars have certbot plugins - you just grab your API key from their customer portal and put it in a file, then run certbot in DNS-01 mode and instruct them to use that. Certbot places a temporary TXT record, which gets verified and the certificate is issued. Then certbot removes the TXT record and that's that. If there's no plugin, you do that by hand, which works but is a bit more involved.
You don't need a firewall for that or a DDNS client. Also if you have a weird registrar that only offers you to set NS records, most VPS providers have free DNS services.
Re:Banish OEM self-signed certs forever and roll your own pr...
by guipsp on Friday March 15, 2024 @11:07AM
(#39716604)
No, not really. You can obtain the certificate externally and use it internally. The DNS challenge type does not require a web server exposed externally either.
Sure, it's far easier not to do it. It's also far easier to have no root password.
If you don't want to expose network details, use something like Tailscale to get unique internal IPs and map those. (Don't use Tailscale's own MagicDNS, that one logs individual certificates for machines into CT rather than giving you a wildcard cert for your tailnet).