I vaguely remember reading something about leaking your private network setup if you used Let’s Encrypt to generate your certificates.
Because of this when I installed my reverse proxy with caddy to handle my selfhosted home network I configured it to generate the certificates locally.
But this comes with the issue of the annoying warnings of the browsers plus being unable to connect to those devices/services which can’t ignore it.
Am I being too paranoid? Is there any real concern about generating the certificates with Let’s Encrypt for addresses which I don’t intend to have outside my private network?
You must log in or register to comment.
I don’t see why you couldn’t just get a wildcard certificate that doesn’t include any hostnames, if you handle your traffic on a single Caddy reverse proxy anyways.
Yup, wildcard with a TXT record of your reverse proxy local IP does it for me
Yeah, solution is just to get a wildcard cert.
Ah, got it!
I’ll look into it, AFAIK caddy autogenerates all certs for each site, so probably I’ll have to manually create and import the wildcard one.
I wrote about the problems last year
https://shkspr.mobi/blog/2022/01/should-you-use-lets-encrypt-for-internal-hostnames/
Not sure what you mean? I don’t use Cloudflare as a CDN.
When I visit the link with JavaScript disabled I get blocked by a site stating “Please wait while your request is being verified…” and then nothing happens even though the actual site behind that screen displays fine without JavaScript.
Are you using a VPN? Can you share a screenshot? I don’t use CloudFlare, but my host does block users which are from IP addresses which have previously been used for abuse.
Tor Browser on Android. It happens on multiple circuits with different exits. Not an image by me, but it looks like this: https://global.discourse-cdn.com/cloudflare/original/3X/c/3/c38eaed81c96ac19e4fd5a69d4257445b391927e.png
Wildcard cert both solves that, and makes life easier since you just have 1 cert for everything.
… in case you don’t know: if it’s for resources on a private home network, you can easily add the CA cert (i.e. the public key associated with the private key used to sign your certs) to your devices so that it’s no longer unknown and the warnings disappear. I know this doesn’t answer your question, but it’s what I’d do instead of using letsencrypt for private services.
Depends on your risk profile, really. It’ll technically leak out the DNS name your using internally in order to generate the cert. But, to get a cert from anything (if not wildcard) you’ll have to do this if you don’t want to spin up your own CA.
It leaks the names of your domains since info about all certificates are published. If that matters too you, a simple solution is to only generate and use a wildcard certificate (*.domain.tld).
