Using LE for proper internal domain

[_az]

@gregnorz

Will Let’s Encrypt work for this internal domain, on internal-only servers? We can easily modify the DNS host to provide a TXT record for validation.

As long as the TXT record can be viewed on the external internet.

@gregnorz

Will the LE certificate still work correctly without this access?

Yes, just OCSP won't work, which isn't fatal to most browser configurations.

@gregnorz

I assume that requests to LE’s CA server would show the internal URLs/FQDN being accessed, correct?

CA wouldn't see anything like URLs, just your certificate domain names and IP addresses of:

1. The host requesting issuance or renewal of the certificate,
2. One of:
   a. Browsers that encounter your certificate, if you do not have OCSP Stapling enabled.
   b. The server using the certificate, if OCSP Stapling is enabled.
   c. Nobody, if you block internet traffic on your browsers and web server.

@gregnorz

Would a wildcard certificate prevent FQDNs from being exposed during a request to the LE CA?

Yes, it would definitely achieve that.