Has any thought been put into providing a method verifying addresses for Private Intranet Sites? Example You if you own the domain example.com and have the subdomain intranet.example.com but it’s only accessible to clients on the company’s internal network Lets Encrypt wont be able to connect to t…

This suggestion seems interesting for this: [image] Shouldn't verification via DNS record be a priority? Issuance Tech @…

We have previously suggested temporary TCP port forwarding or obtaining the cert on one (temporarily public) machine and then copying it and the private key onto a non-publicly-visible machine. I think the most secure approach is to generate a private key and CSR on the internal machine and then us…

The issue is if you don’t have a split DNS, or have no feasible way to make the server (as exactly named) publicly accessible. If you have a split dns to where you could serve up a different dns to the outside world, sure - it’s super easy to use any of the alternatives. However, that doesn’t addr…

@nneul , that seems like a good explanation of the problem. I don’t expect this verification method to be available before Let’s Encrypt’s general availability.

I have absolutely same problem intranet.example.com published only in local DNS, nothing in publich DNS so I can’t create certificated at now, because didn’t exists record in public DNS if would exists any solution, it would be great

@schoen Any idea where this (or other DNS based validation methods) might site on the priorities list/timetable now that you’re in public beta? I have 100+ internal devices that I would jump at the chance to use LE for, but can’t currently due to the validation constraints and the way our DNS is set…

I don’t wanna sound like I’m against it, but if that intranet is anyways only reachable behind company firewalls from the inside of the company network, I think it is an options to throw in an own CA just for that purpose. Setting up an internal CA for that is no problem in neither in the Windows no…

Yeah, and we’ve done that to a limited degree - but there are quite a few people, with locked down windows boxes, and lack of support/interaction with domain admins/etc. Being able to fully automated it, with known trusted certs, using the easy capabilities provided by LE would be ideal. There’s a…

@RouL Setting up an internal CA for that is no problem If that would really be the case, the question would not have been brought up in the first place. In fact it's a huge problem, especially for small or mid-range companies. Besides of typical problems arising by simple PKI operations (key sto…

Ok, I must confess, I didn’t took BYOD into account. That indeed can be a problem. Anyways, I’m not against DNS based domain ownership verification, I indeed support it for other reasons. I only wanted to offer a possible solution. :blush:

Securing Private Intranet Sites

Issuance Tech

riking October 7, 2015, 9:01pm 2

This suggestion seems interesting for this:

Topic		Replies	Views
Configuring Internal Environment to Suit Externally Validated Domains Help	12	4153	May 15, 2017
Certificate for public IP without domain name Issuance Tech	84	248852	September 20, 2018
Proposed draft on "what if I can't allow incoming connections from the whole Internet?" ISRG/Organizational	14	972	April 19, 2024
Implement port knocking Feature Requests	55	3377	February 5, 2022
Let's Encrypt for Internal-Only Web Management Help	13	35154	August 21, 2021

Securing Private Intranet Sites

Related topics