I have a publicly accessible domain name that can be resolved by DNS on the broad internet ( mypublicdomain.com ). I am interested in getting certs for many services that are internal to my LAN, for which I have a local domain not accessible outside of my LAN (inernal.local is the domain, service.inte…

All names in the certificate (both Subject and SAN, both FQDN and wildcard) need to be publicly accessible and able to be validated by Let's Encrypt. Instead, you can get a wildcard cert for *.mypublicdomain.com, and use your internal DNS server to advertise your private local services as service.m…

Well that makes complete sense and is also a bummer, since my external domain is long and a pain to type. My local domain was made to be convenient, easy to remember, and quick to type. So it sounds like I have to make a choice: certs that just work with no intervention or the ease/ convenience of m…

[image] georgev93: So it sounds like I have to make a choice: As a third option: You could pay for another [much shorter] domain solely for this "internal use" purpose

What do I look like, a millionaire!? Am I sitting over here with my top hat and monocle!? Jk, that is certainly an option as well. Although, it's hard to beat the brevity of my internal domain and I've already gotten family/guests trained on those urls. I think I'm going to have to stick with the l…

You can create a very long-lived and self-signed cert [with any local name(s) of your choosing]. And then simply have all your clients manually trust that single cert [only a onetime thing for them].

Rather than a truly self-signed cert, a better way to go might be to create a CA cert, and use that to issue a cert for your local domain. Then trust the CA cert on the client machines. I suggest that because, in my experience, it's hard to get browsers to not gripe about self-signed certs.

It may be a bit more work but well worth the effort [indeed].

The obvious next step would be: Build a Tiny Certificate Authority For Your Homelab Let's make a tiny, standalone CA! We'll use a Raspberry Pi 4, YubiKey 5 NFC, and Infinite Noise TRNG. ...but it might be overkill for this situation.

Definitely overkill. But a very nice learning opportunity - if one should be into such things.

Yep, I use my own CA for self signing, then add that CA to my devices so I can trust additional certs I make. The only problem there is the iPhone on my home network that doesn't let me add trusted CAs. I've got a separate forum thread on Apple's forum about that, but no one seems to know how to hel…

[image] georgev93: What do I look like, a millionaire!? :wink: [image] 1.111B Class Search | .xyz Domain Names | Join Generation XYZ The first-of-its-kind segment of domain names Use the search tool below to innovate on the affordable class of .xyz domains made up of 1.111 billio…

Local Domain certs with Let's Encrypt CA

Help

danb35 January 20, 2024, 2:43pm 9

The obvious next step would be:

...but it might be overkill for this situation.

How to generate an SSL certificate for a internal-only domain that’s not on the Internet?

Need to secure my internal website

Topic		Replies	Views
Local Domain Certificate Help	4	35032	December 25, 2020
How can I use Let's Encrypt to make internal certs? Help	4	25782	February 17, 2023
How to generate an SSL certificate for a internal-only domain that’s not on the Internet? Help	6	7764	July 19, 2024
Using Valid SSL on limited network Server	6	3069	September 12, 2017
Internal domain with internal DNS Help	4	268	March 28, 2026

Local Domain certs with Let's Encrypt CA

Related topics