Certificates for hosts on private networks

Issuance Policy
35

This thread has some high Google juice, so here are some instructions on how to get certificates for private IP’s on letsencrypt.

Requirements: a domain name (example.com), access to the DNS server for example.com, root access on a publicly accessible server (server.example.com). And let’s assume you want to create a certificate for 192.168.7.7 named foo.example.com

  1. install certsling on the server.
  2. Add an A record to point foo(.example.com) to 192.168.7.7
  3. Add an NS record to point _acme-challenge.foo(.example.com) to server.example.com
  4. sudo socat -T15 udp4-recvfrom:53,reuseaddr,fork tcp:localhost:8053 on your server
  5. open port 53 on your server firewall
  6. mkdir myemail@example.com
  7. cd myemail@example.com
  8. certsling -s --dns foo.example.com to get certs from the letsencrypt staging server
  9. When step 8 works, rm -rf *
  10. certsling --dns foo.example.com to get real certs

Your certs will be in "myemail@example.com/foo.example.com/"!

1 Like