# Certbot / FQDN for local network **URL:** \ **Category:** Help\ **Created:** [June 6, 2023, 9:06am UTC](https://community.letsencrypt.org/t/certbot-fqdn-for-local-network/199597 "2023-06-06T09:06:43Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Krambo-GER](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/krambo-ger/32/70985_2.png) [@Krambo-GER](https://community.letsencrypt.org/u/Krambo-GER)\ **Post date:** [June 6, 2023, 9:06am UTC](https://community.letsencrypt.org/t/certbot-fqdn-for-local-network/199597/1 "2023-06-06T09:06:43Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: .lan / -lan I ran this command: sudo snap install --classic certbot It produced this output: Error creating new order :: Cannot issue for "atak.lan": Domain name does not end with a valid public suffix (TLD) My web server is (include version): The operating system my web server runs on is (include version): Ubuntu Server 20.04 LTS My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don't know): yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): Hello, i would like to run CertBot / FQDN for a local server without permanent internet access. I want to run a programm called ATAK on a local network over Wi-Fi. I builded a little box for a router and a Raspberry Pi to make it movable. Im not a big linux guy but on github you find a script that installs everything for you including FQDN using certbot. Link to script: [GitHub - atakhq/takserver-deb-installer: Setup TAK Server 4.8 or 4.9 in ~10 min on Ubuntu (20.04) with: certificate enrollment, optional FQDN with letsencrypt SSL, user certificate generation, simple-rtsp-server for video streaming.](https://github.com/atakhq/takserver-deb-installer) When i run the script it installs certbot and wants to know my Hostname / Domain Name etc. But Certbot seems not to like my .lan Domain and gives me this message: Error creating new order :: Cannot issue for "atak.lan": Domain name does not end with a valid public suffix (TLD) Is there a way to fix this or work around? I very glad for any help! As i sad im not big into linux and not into certbot at all but i would be awesome to get this running! If any more information is needed please let me know! Thanks! ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [June 6, 2023, 9:22am UTC](https://community.letsencrypt.org/t/certbot-fqdn-for-local-network/199597/2 "2023-06-06T09:22:21Z")
> [@Krambo-GER](#): > > Is there a way to fix this or work around? No, the top level domain (TLD) `.lan` is not a public TLD. While I can't seem to find a RFC or IANA registry where the `.lan` TLD is actually officially registered as a private TLD, most documents from official organisations such as IANA mention the `.lan` TLD as being private. See e.g. [https://www.icann.org/en/system/files/files/sac-113-en.pdf](https://www.icann.org/en/system/files/files/sac-113-en.pdf) As Let's Encrypt is a public CA, it is not allowed to issue certificates for private TLD. It can only issue certificates for public domains as it is required to validate the hostname using the public internet. Thus, to be able to use LE, you need a publicly available domain name. See also: > **[Certificates for localhost - Let's Encrypt](https://letsencrypt.org/docs/certificates-for-localhost/)** > > Sometimes people want to get a certificate for the hostname “localhost”, either for use in local development, or for distribution with a native application that needs to communicate with a web application. Let’s Encrypt can’t... It's a whole different story if you'd like to use Certbot in combination with your _own selfhosted CA_ of course. For example, `mini-ca` ([GitHub - jsha/minica: minica is a small, simple CA intended for use in situations where the CA operator also operates each host where a certificate will be used.](https://github.com/jsha/minica), no ACME support, but probably also not necessary for simple environments) or `step-ca` ([`step-ca` server](https://smallstep.com/docs/step-ca/), uses ACME, probably more for bigger companies) could do that. ---
**Author:** ![Krambo-GER](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/krambo-ger/32/70985_2.png) [@Krambo-GER](https://community.letsencrypt.org/u/Krambo-GER)\ **Post date:** [June 6, 2023, 9:47am UTC](https://community.letsencrypt.org/t/certbot-fqdn-for-local-network/199597/3 "2023-06-06T09:47:47Z")
Thanks for the quick answer! The mini-ca looks like what i need. I will not have more then 30 users in my network connecting to the server so that should be fine. ---
**Author:** ![jvanasco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jvanasco/32/55900_2.png) [@jvanasco](https://community.letsencrypt.org/u/jvanasco)\ **Post date:** [June 6, 2023, 3:48pm UTC](https://community.letsencrypt.org/t/certbot-fqdn-for-local-network/199597/4 "2023-06-06T15:48:50Z")
You can still use a LetsEncrypt certificate in private lans, by obtaining a certificate for a public domain extension on the public internet via DNS-01 challenge (or completing the HTTP-01 challenge with a public server and copying that certificate onto your system). That will allow you to avoid installing the private root certificate on the client machines. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [June 6, 2023, 4:12pm UTC](https://community.letsencrypt.org/t/certbot-fqdn-for-local-network/199597/5 "2023-06-06T16:12:53Z")
> [@jvanasco](#): > > public domain extension For extra clarity/reminder: which the `.lan` TLD is not. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [July 6, 2023, 4:13pm UTC](https://community.letsencrypt.org/t/certbot-fqdn-for-local-network/199597/6 "2023-07-06T16:13:20Z")
Closed on July 6, 2023, 4:13pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.