TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt

156 点作者 gcds超过 4 年前

20 条评论

lgbr超过 4 年前
Cert-manager has great support for a number of providers[0] including AWS, CloudFlare, Google Cloud, and Azure.<p>I recommend this not just for internal IP setups, for actually for all setups, since DNS verification is more robust than HTTP verification, particularly if you have issues with load balancers, or if Let&#x27;s Encrypt decides to deprecate a protocol again [1].<p>[0] <a href="https:&#x2F;&#x2F;cert-manager.io&#x2F;docs&#x2F;configuration&#x2F;acme&#x2F;dns01&#x2F;#supported-dns01-providers" rel="nofollow">https:&#x2F;&#x2F;cert-manager.io&#x2F;docs&#x2F;configuration&#x2F;acme&#x2F;dns01&#x2F;#suppo...</a> [1] <a href="https:&#x2F;&#x2F;community.letsencrypt.org&#x2F;t&#x2F;upcoming-tls-sni-deprecation-in-certbot&#x2F;76383" rel="nofollow">https:&#x2F;&#x2F;community.letsencrypt.org&#x2F;t&#x2F;upcoming-tls-sni-depreca...</a>
评论 #24362810 未加载
评论 #24362703 未加载
评论 #24365125 未加载
windexh8er超过 4 年前
I do this with Traefik [0] internally in almost the same way. I use DNS-01 to get a Let&#x27;s Encrypt wildcard cert and all my internal A records point to the ingress IP and Traefik happily proxies the communications to the appropriate service - container based and non-container based - which is the real win I was looking to solve for in my home environment. The thing I like about just using Traefik is it doesn&#x27;t rely on a lot of extraneous tooling (can just use Docker without Swarm&#x2F;K8s) and will automatically consume orchestration services if I&#x27;d like it to. But the reality is the majority of things I want valid certs for are static mappings. One config file update of a few new lines of boilerplate is all it takes to get a valid cert fronting any service. And then to get a dashboard of all my internal services I use Heimdall [1].<p>[0] <a href="https:&#x2F;&#x2F;docs.traefik.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;docs.traefik.io&#x2F;</a> [1] <a href="https:&#x2F;&#x2F;heimdall.site&#x2F;" rel="nofollow">https:&#x2F;&#x2F;heimdall.site&#x2F;</a>
评论 #24366455 未加载
aforwardslash超过 4 年前
Keep in mind, adding local entries to your external DNS will expose internal details of your network, such as hostnames and IPs. Same goes for Let&#x27;s Encrypt, due to Certificate Transparency logging.
评论 #24362531 未加载
评论 #24362563 未加载
评论 #24362892 未加载
评论 #24366793 未加载
评论 #24367917 未加载
评论 #24369506 未加载
评论 #24371869 未加载
评论 #24362641 未加载
Schwan超过 4 年前
Its TLS and not SSL. Its TLS for a long time now...<p>And yes be aware that through this, it works fine but you are also exposing your internal infrastructure details through dns.<p>I&#x27;m not seeing a big issue, just be aware of it.
评论 #24363878 未加载
评论 #24364438 未加载
评论 #24363753 未加载
评论 #24365883 未加载
danShumway超过 4 年前
I wrote a similar post about a year ago[0], but even at the time I wasn&#x27;t the first to come up with this idea. As someone who doesn&#x27;t have a lot of experiences with DNS security, seeing other people floating similar setups without significant pushback gives me more confidence that the core idea isn&#x27;t horribly unsafe. I&#x27;m pretty happy&#x2F;relieved to see other people playing around in the same space.<p>My perspective was (and is) that for portable devices (phones&#x2F;laptops) that are interfacing with locally hosted services, having SSL for those services is really important because your device probably isn&#x27;t configured to check what network it&#x27;s on before automatically pinging 192.168.1.x. This is doubly important if you have other people occasionally hopping onto your network and connecting to those same services. It&#x27;s imo bad practice to ask everyone connecting to your network to install certificates or set up a certificate manager. I wouldn&#x27;t do that for any of my personal devices if someone asked me to.<p>To push this a step farther, I imagined a world where my services could handle not just renewing their own certificates, but also updating their addresses if they were moved to a different network&#x2F;address. If I build a physical device to give to someone, I&#x27;d like them to be able to plug it into their network, go to a web URL, and have everything just work -- no messing around with their internal DNS settings or worrying about whether they&#x27;re using DNS over HTTPS in Firefox.<p>[0]: <a href="https:&#x2F;&#x2F;danshumway.com&#x2F;blog&#x2F;encrypting-internal-networks&#x2F;" rel="nofollow">https:&#x2F;&#x2F;danshumway.com&#x2F;blog&#x2F;encrypting-internal-networks&#x2F;</a>
swiley超过 4 年前
I’ve tried to set up kubernetes at home a couple of times and I always freak out at the amount of layers and “just run this” style of tutorials. Am I crazy?<p>I’ve heard guix has some kind of container management thing. I’ve been thinking about trying it anyway.
评论 #24362942 未加载
评论 #24363046 未加载
评论 #24362976 未加载
viro超过 4 年前
Honestly this feels overly complex when you can just create a CA and add the CA to ur devices. Still cool tho.
评论 #24365312 未加载
评论 #24364986 未加载
评论 #24365747 未加载
Naac超过 4 年前
I just created a wildcard with letsencrypt in the format of <i>.internal.mydomain.com<p>My public services all run out of </i>.mydomain.com and all my internal services run out of <i>.internal.mydomain.com<p>I have my internal dns set to resolve any </i>.internal calls to an internal load balancer which hosts the ca certs.<p>The downside is that all internal services are ssl terminated at the load balancer, but this makes handling internal certs easy as they&#x27;re rotated in a single location. This is Good Enough for my homelab.
alexellisuk超过 4 年前
inlets with the inlets-operator [0] does this by using the HTTP01 challenge, and gives you a LoadBalancer just like you&#x27;d have on AWS. The benefit is that you get a real IP and routable traffic, there&#x27;s no tricks required. It would also work with DNS01 if that&#x27;s of interest.<p>[0] <a href="https:&#x2F;&#x2F;github.com&#x2F;inlets&#x2F;inlets-operator" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;inlets&#x2F;inlets-operator</a><p>Feel free to check it out in this tutorial: <a href="https:&#x2F;&#x2F;docs.inlets.dev&#x2F;#&#x2F;get-started&#x2F;quickstart-ingresscontroller-cert-manager" rel="nofollow">https:&#x2F;&#x2F;docs.inlets.dev&#x2F;#&#x2F;get-started&#x2F;quickstart-ingresscont...</a>
guerby超过 4 年前
I haven&#x27;t tried it yet but if you have control of your DNS and want automation:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;joohoi&#x2F;acme-dns&#x2F;" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;joohoi&#x2F;acme-dns&#x2F;</a><p><a href="https:&#x2F;&#x2F;github.com&#x2F;joohoi&#x2F;acme-dns-certbot" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;joohoi&#x2F;acme-dns-certbot</a><p>A simplified DNS server with a RESTful HTTP API to provide a simple way to automate ACME DNS challenges.
user5994461超过 4 年前
This page is raising a ton of security alerts:<p>&quot;NoScript detected a potential Cross-Site Scripting attack from <a href="https:&#x2F;&#x2F;www.techprowd.com" rel="nofollow">https:&#x2F;&#x2F;www.techprowd.com</a> to <a href="https:&#x2F;&#x2F;carbon.now.sh&quot;" rel="nofollow">https:&#x2F;&#x2F;carbon.now.sh&quot;</a><p>Images are failing to load too. Not sure what&#x27;s going on.<p>edit: Probably some misusing of DNS rather than actual attack but who knows. Author should fix the site.
评论 #24362923 未加载
评论 #24362929 未加载
Hitton超过 4 年前
It&#x27;s not a certificate for internal ip address, it&#x27;s a certificate for host name. Ip address is irrelevant here.
phrygian超过 4 年前
I use step-ca [0] for these sort of things and it works brilliantly. I barely see the point of having external DNS servers resolving your internal infrastructure.<p>[0] <a href="https:&#x2F;&#x2F;smallstep.com&#x2F;certificates&#x2F;" rel="nofollow">https:&#x2F;&#x2F;smallstep.com&#x2F;certificates&#x2F;</a>
评论 #24363664 未加载
rackforms超过 4 年前
No association what so ever to &#x27;em but I so dearly love what they do, I&#x27;d encourage users to donate to keep them going healthy and strong!<p><a href="https:&#x2F;&#x2F;letsencrypt.org&#x2F;donate&#x2F;" rel="nofollow">https:&#x2F;&#x2F;letsencrypt.org&#x2F;donate&#x2F;</a>
ttouch超过 4 年前
I did that, the very hard way (I didn’t know better at the time): <a href="https:&#x2F;&#x2F;whynot.fail&#x2F;homelab&#x2F;lets-encrypt-the-house&#x2F;" rel="nofollow">https:&#x2F;&#x2F;whynot.fail&#x2F;homelab&#x2F;lets-encrypt-the-house&#x2F;</a>
digitalsanctum超过 4 年前
Another alternative is inlets which automates all of the steps necessary and offers Layer 4 as well as Layer 7: <a href="https:&#x2F;&#x2F;docs.inlets.dev&#x2F;#&#x2F;" rel="nofollow">https:&#x2F;&#x2F;docs.inlets.dev&#x2F;#&#x2F;</a>
varbhat超过 4 年前
Instead of using hacky fragile methods , use<p><a href="https:&#x2F;&#x2F;github.com&#x2F;FiloSottile&#x2F;mkcert" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;FiloSottile&#x2F;mkcert</a><p>to automate setting up local CA and making it trusted.
评论 #24362995 未加载
评论 #24363685 未加载
berbec超过 4 年前
Why not just get a wildcard LE cert and not worry about it?
aasasd超过 4 年前
TLDR:<p>- have a proper worldwide domain<p>- obtain a certificate for that domain<p>- point the domain to local IPs in your network and use the certificate on the local server.<p>Doesn&#x27;t change that you&#x27;d need to self-sign certs for .local or other funky domains.
评论 #24363235 未加载
jimueller超过 4 年前
split dns is typically the solution for this, is it not?