I'm asking this question, with a clear mind, 170 days after my last internal-only Let's Encrypt certificate expired. I'm frustrated at the difficulty level involved - along with the 90-day expiration date, requiring automation (that seems to break regularly and is not easy to set-up for internal-onl…

[image] Amarand: Is this ever going to work for me? Does your firewall have an automated way to update the cert? If not, and you aren't able to create one, then no, it really isn't. [image] Amarand: My domain is: Internal Only (192.168.10.1) This is also a problem; Let's Encrypt at t…

[image] Amarand: Am I the only person trying to do this? No, you're not. This is quite a common scenario in (enterprise) networks. Solving this might not be entirely straightforward though - more below. [image] Amarand: Problem: Let's Encrypt can't talk to my internal network, and the we…

As @Nummer378 said, the common approach to your scenario is installing a private or self-signed certificate. If you wanted to use LetsEncrypt, the easiest method is to use the DNS-01 challenge to prove ownership and have DNS for a hostname on your domain point to the local IP. You must periodically…

[image] Nummer378: For an internal LAN, where you own or control the devices, there really is no need for a certificate from Let's Encrypt - instead you can be your own certificate authority ! This is an excellent recommendation. Let's Encrypt provides some relevant information about a develo…

So it seems like the only on-board solution requires adjusting my DNS entries every 60-90 days, which I suspect my firewall probably can't do. Or if it can do it, it's going to be a mess figuring out how to make pfsense integrate with my service provider's DNS protocols. The primary solution that m…

[image] Amarand: So, let's focus on the Let's Encrypt solution: is there a way for my pfsense firewall to talk to my service provider to perform the automated and regular DNS updating procedure? https://docs.netgate.com/pfsense/en/latest/packages/acme/index.html

[image] Amarand: is there a way for my pfsense firewall to talk to my service provider to perform the automated and regular DNS updating procedure? Have you even looked? pfSense can update many DNS providers; here are just some of them: [image] I suspect it can handle all the providers th…

Have you even looked? pfSense can update many DNS providers; here are just some of them: At one point, back 170-ish days ago, I did look at that list. Saw that my previous provider (SiteGround) wasn't on the list. Then I switched over to InMotion Hosting, which is also not on the list. Sadly. I …

[image] Amarand: I switched over to InMotion Hosting, OK, so you switched your Hosting Service Provider (HSP). But who is your DNS Service Provider (DSP)? HSPs and DSPs are not mutually inclusive. For instance, you could quite easily switch to use Cloudflare DNS (as your DSP only). [you a…

Let's Encrypt for Internal-Only Web Management

Help

danb35 August 19, 2021, 3:40pm 5

...and I've lost track of how many times I've posted this link, but it's a really handy solution for this problem:

Topic		Replies	Views
Configuring Internal Environment to Suit Externally Validated Domains Help	12	4144	May 15, 2017
Advice for a Newby Help	15	1256	August 7, 2022
Securing Private Intranet Sites Issuance Tech	21	33418	June 15, 2016
Private domain and renewal periods Help	13	4008	October 21, 2019
Local DNS Server interfering with issuing certificates Help	22	3625	December 5, 2020

Let's Encrypt for Internal-Only Web Management

Related topics