Help Creating an ACME certificate for internal DNS over TLS

Help
1

Creating an ACME certificate for internal DNS over TLS in pfSense. What method do I chose depicted in the screenshot attached, Any other suggestions would be helpful.

My domain is: myvmlab.net

I ran this command: pfSense 2.7.2

It produced this output: don't know yet

My web server is (include version): internal pfSense

The operating system my web server runs on is (include version): pfSense

My hosting provider, if applicable, is: n/a

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): pfSense ACME

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): pfSense ACME

dns_res_s
dns_res_s1294Ă—976 142 KB

ACME Cert q
ACME Cert q1306Ă—1083 180 KB

2

Hello @mrvmlab, welcome to the Let's Encrypt community. :slightly_smiling_face:

Please see:

1 Like
3

This is not a case of wanting a certificate for localhost. This is a certificate for use with DoT, although I am not sure why an existing certificate cannot be used or why the challenge is not automated using Cloudflare.

I don't know what the question really is, or how it relates to Let's Encrypt. Maybe @mrvmlab can help us with some more relevant details.

4 Likes
4

Yeah; I agree, but "... certificate for internal DNS ..." was perplexing me.

1 Like
5

...resolver.

Whether or not it serves local data won't affect needing a valid hostname and matching certificate for DoT.

I use LAN subdomain wildcards exported from pfSense with the equivalent of a deploy-hook.

4 Likes
6

I was thinking of an internal test lab at a company that needs distributed DNS & TLS for testers.

1 Like
7

@linkp I will try to keep this short I am running pfSense and I have DNS over TLS setup for external DNS. That works great. I see where I can also with in pfSense offer DNS over TLS to my internal clients ( HomeLab ) It is not working internally and the only results as to why it may be is due to a certificate being the issue ( self singed ) So I wanted to issue a certificate based on my registered domain name with ACME and use that. How ever I did not know what Method to use under the Domain SAN list when filling in the Services>ACME>Certificate options Edit. So this very well may be a question for Netgate support rather then Let's Encrypt I am not 100% sure.

8

Almost like that yet more of internal DNS over TLS forlocal LAN clients (homelab)

1 Like
9

Just a (homelab) trying to get local internal LAN clients internal DNS to be DNS Over TLS

1 Like
10

Does need to be a certificate for TLS to be the public trusts?
Do you desire it to use a certificate for TLS that is in the public trusts?

1 Like
11

if it can use domain name like android you can just use plain LE certificate: if you need a certificate for RAW IP address: LE doesn't offer it now. For public IP I think there is commercial CAs that are willing to sell you some: zerossl by api and google trust service comes to mind

3 Likes
12

Within a home lab, you usually don't need a publicly-trusted certificate like those issued by Let's Encrypt. You can likely issue your own certificate from your own internal certificate authority, and make the other devices on the network trust that authority.

3 Likes
13

That is correct @schoen; however I do not fully understand what the OP is exactly trying to accomplish and what they would like. Thus the reason for the question.

3 Likes
14

@mrvmlab if you are looking for your own lab ACME CA see My own certificate authority - #10 by danb35

1 Like