Private domains, NAT, and Let's Encrypt

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: eng.networktest.com

I ran this command:

NULL - I am posting a procedural question

It produced this output:

NULL - I am posting a procedural question

My web server is (include version):

Mix of apache24-2.4.33 and nginx-1.14.0,2

The operating system my web server runs on is (include version):

Mix of FreeBSD 11.1 and Debian 3.16.51-3+deb8u1

My hosting provider, if applicable, is:

Self-hosted

I can login to a root shell on my machine (yes or no, or I don't know):

yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

no

Greetings. I manage the DNS servers for networktest.com. Several subdomains (e.g., eng.networktest.com) are behind a NAT box and are not visible in the public DNS. Currently, internal hosts use an internal CA or self-signed certs.

About 15 months ago, someone else asked if it was possible to use Let's Encrypt in a similar scenario involving private domains:

At that time, the answer was no. My questions:

  1. Is this still the case (i.e., does Let's Encrypt always require an IP address or DNS RR visible on the public Internet?)?

  2. If Let's Encrypt now does support certs for private hosts and/or domains, is there documentation available for this? I did not see anything in the docs or on this forum but I may have missed it. I did find references to a TXT record using the DNS-01 challenge type to prove domain ownership, but I'm unclear if that applies to NAT'd hosts and domains.

Thanks in advance! This seems as though it's a pretty standard problem.

2

Hi,

In short, yes. LE can only issue certificates to public domains.

In order for LE to issue a certificate, you'll need:
A PUBLIC DOMAIN (E.G. NOT .LOCAL, and public resolvable)
And
A public IP / a set of public reachable DNS server.

You can still obtain a certificate using DNS-01.(especially obtain a wildcard certificate by adding records to root domain)

For internal certificates (.local etc), it's better to use self-signed ca.
For domains that has internal IP (but DNS server can be queried outside the network), you can use DNS-01 validation.

I see that your domain is NetworkTest.com and they have public queriable DNS servers.

Although it may not be ideal to obtain a certificate via http (since you said it's internal and Nat), you can request wildcard certificates by adding txt records on root domain.

Thank you

1 Like
3

Thanks for the speedy response. To be sure I understand:

For domains that has internal IP (but DNS server can be queried outside the network), you can use DNS-01 validation.

The "DNS can be queried" part of this means internal subdomains or hosts (i.e, sub1.networktest.com or somehost.sub2.networktest.com) need to be listed in the public DNS, yes?

If so, that rules out LE for internal use. I use split-brain (aka split-namespace) DNS, where the external nameservers don't know about the internal domains. If this is indeed the case, I can stick with the self-signed CA, but thought I'd check.

Thanks again

4

Can you create public TXT records for _acme-challenge.sub1.networktest.com and _acme-challenge.somehost.sub2.networktest.com?

5

Hi,

This depends on how you want to issue the certificates.

If you want to issue the cert in per host basis, as @mnordhoff's example, LE probably can't issue the certificate. (Since those hosts don't show on queries)

However, what i'm saying is, you can still create a wildcard certificate. (Which covers *.networktest.com) and need you to create records on (_acme-challenge.networktest.com) (I think this can be archived since your DNS server is responding to queries on your root domain)

Thank you

6

The hosts don't need A or AAAA records, though.

7

Thank you both for responding. I certainly can create a record to do a wildcard cert for networktest.com, and that should cover any internal subdomain or host. True?

If so, is this howto guide for certbot still a valid procedure?

Thanks again!

8

A wildcard covers one level of subdomains, so *.networktest.com would cover something.networktest.com but not something.sub.networktest.com for example. That’s true whether they’re internal or external. On the other hand you can get a cert with up to 100 names and any or all of those names can be wildcards, so you could get *.networktest.com, *.sub1.networktest.com, *.sub2.networktest.com etc if that makes sense for the names you want to use. Of course to get *.sub1.networktest.com you need to be able to create a public TXT record for _acme-challenge.sub1.networktest.com.

9

Thanks for this. Regarding this bit:

I'm unclear if the "something" in your second example is a) a hostname, or b) a sub-subdomain, or c) either a hostname or a domain.

Put another way: For a host with an FQDN of "myhost.mysubdomain.networktest.com" and a wildcard cert for *.networktest.com, is it right that the cert wouldn't cover that host?

I think the correct answer here is is that the public TXT record would need to include *.networktest.com, *.mysubdomain.networktest.com, *.sub2.networktest.com, as you say -- but just checking...

Thanks again.

10

That's correct, the cert would not cover that.

11

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.