Private domains, NAT, and Let's Encrypt

[stevenzhu]

Hi,

@NetworkTest

Is this still the case (i.e., does Let’s Encrypt always require an IP address or DNS RR visible on the public Internet?)?

In short, yes. LE can only issue certificates to public domains.

In order for LE to issue a certificate, you'll need:
A PUBLIC DOMAIN (E.G. NOT .LOCAL, and public resolvable)
And
A public IP / a set of public reachable DNS server.

@NetworkTest

If Let’s Encrypt now does support certs for private hosts and/or domains, is there documentation available for this? I did not see anything in the docs or on this forum but I may have missed it. I did find references to a TXT record using the DNS-01 challenge type to prove domain ownership, but I’m unclear if that applies to NAT’d hosts and domains.

You can still obtain a certificate using DNS-01.(especially obtain a wildcard certificate by adding records to root domain)

For internal certificates (.local etc), it's better to use self-signed ca.
For domains that has internal IP (but DNS server can be queried outside the network), you can use DNS-01 validation.

I see that your domain is NetworkTest.com and they have public queriable DNS servers.

Although it may not be ideal to obtain a certificate via http (since you said it's internal and Nat), you can request wildcard certificates by adding txt records on root domain.

Thank you