undefined | Better HN

0 pointsgregmac4y ago0 comments

> Create a self-signed root cert,

The OP was specifically talking about a small business with no IT. I'd say it applies equally to a home.

I'm sure there's some ways to manage all the non-domain-connected computers, phones, tablets, chromebooks and other stuff in my house (which is going to vary by ecosystem) and "push" a root cert out, but I sure don't want to spend the time to learn all that just to secure a web app I have running.

The magic of Lets Encrypt is you run something on the server you're securing, and a few minutes later you're done -- it works with everything.

0 comments

5 comments · 2 top-level

Helmut100014y ago· 3 in thread

If self-signed certificates are too much, then perhaps this is, too - You can use Let's Encrypt SSL certs locally for the Intranet/LAN as well. Get a wildcard SSL cert for a lan-reserved subdomain of a TLD (e.g. local.mytld.com) through a DNS API (e.g. cloudflare - any other DNS API works, too). Override DNS entries in your router to redirect to local services, e.g.: cloud.mytld.com -> 192.168.0.10 gitlab.mytld.com -> 192.168.0.11

You can have your services individually query Let's encrypt (ACME), or have your router get the wildcard cert and deploy this locally (e.g. ssh, ftp). No one external can reach your services, no one external knows how your services are called (in case of wildcard certs). You do not need to open any port for this.

magicalhippo4y ago

Inspired by this thread I just did this, except not with the wildcard.

I have a droplet at Digital Ocean, so I used their DNS service. I configured some CNAME records for the local services, pointing to the internal names[1]. I then configured my PiHole with a local DNS CNAME record, pointing service.local.example.com to service.localdomain.

Since my PiHole is not the DHCP server, I had to add a local DNS record for service.localdomain which matched the static IP that my router gives out. It seems the conditional forwarding done by PiHole happens earlier in the resolution process.

I could then configure my services to use the DNS challenge for service.local.example.com, using the DO plugin for certbot[2] or just acme.sh[3], depending on what was available.

I didn't get it to work immediately on Android devices, until I discovered that Android only uses IPv6 DNS servers if it has an IPv6 address, and I hadn't configured that in my router. So added the static ULA address of the PiHole lease to the DHCPv6 DNS server announcement[4].

Was a bit of fiddling since I'm a networking nub, but went smoother than I had feared.

Not sure how to best distribute certificates though, if I had found a way I could let the router do all the renewals.

[1]: Not sure if this is needed but didn't bother experimenting with removing it yet.

[2]: https://certbot-dns-digitalocean.readthedocs.io/en/stable/

[3]: https://github.com/acmesh-official/acme.sh/wiki/dnsapi#20-us...

[4]: https://openwrt.org/docs/techref/odhcpd#dhcp_section

Helmut100014y ago

> pointing service.local.example.com to service.localdomain

Not sure if I understand correctly, but service.local.example.com must point to your internal IP. You do not need a localdomain and the SSL certs will only work for what they were generated for (service.local.example.com). However, you can very much point your local DNS server's entry for service.local.example.com to any local IP, resolving these services internally. For that matter, you can equally simply edit the `hosts` file and add overrides.

For the ACME-certs I suggest using the fullchain-cert that you get from Let's Encrypt for service.local.example.com (e.g. in the nginx reverse proxy). Firefox/Chrome will typically not complain if you do not serve intermediate CA SSL certs, but it is better to provide the full chain of certs.

> Not sure how to best distribute certificates though, if I had found a way I could let the router do all the renewals.

My router is pfsense, I added a hook that stores SSL certs to a local NAS folder via script:

Action List: `sh /conf/acme/store_certs_nas.sh`.

From there, it is easy to pull certs through cronjobs on services.

1 more reply

Helmut100014y ago

Typo:

gitlab.mytld.com and cloud.mytld.com

should have been: gitlab.local.mytld.com and cloud.local.mytld.com

5Qn8mNbc2FNCiVV4y ago

At home you either don't need to secure it or if you do, you'll have to learn it.

And when you are in a small business with no IT and want to share salary data, well, you can print it and give it to the employer in an envelope. No need to go digital when doing it analog is not a big problem

j / k navigate · click thread line to collapse

0 comments

5 comments · 2 top-level

Helmut100014y ago· 3 in thread

magicalhippo4y ago

Inspired by this thread I just did this, except not with the wildcard.

I could then configure my services to use the DNS challenge for service.local.example.com, using the DO plugin for certbot[2] or just acme.sh[3], depending on what was available.

Was a bit of fiddling since I'm a networking nub, but went smoother than I had feared.

Not sure how to best distribute certificates though, if I had found a way I could let the router do all the renewals.

[1]: Not sure if this is needed but didn't bother experimenting with removing it yet.

[2]: https://certbot-dns-digitalocean.readthedocs.io/en/stable/

[3]: https://github.com/acmesh-official/acme.sh/wiki/dnsapi#20-us...

[4]: https://openwrt.org/docs/techref/odhcpd#dhcp_section

Helmut100014y ago

> pointing service.local.example.com to service.localdomain

> Not sure how to best distribute certificates though, if I had found a way I could let the router do all the renewals.

My router is pfsense, I added a hook that stores SSL certs to a local NAS folder via script:

Action List: `sh /conf/acme/store_certs_nas.sh`.

From there, it is easy to pull certs through cronjobs on services.

1 more reply

Helmut100014y ago

Typo:

gitlab.mytld.com and cloud.mytld.com

should have been: gitlab.local.mytld.com and cloud.local.mytld.com

5Qn8mNbc2FNCiVV4y ago

At home you either don't need to secure it or if you do, you'll have to learn it.

j / k navigate · click thread line to collapse