There's no question in my mind, letsencrypt is a major boon the the entire Internet.
this post was submitted on 19 Jun 2023
57 points (100.0% liked)
Selfhosted
39516 readers
782 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 1 year ago
MODERATORS
Hard to believe you used to have to pay for a TLS certificate. I use Let's Encrypt with cert-manager on my kubernetes cluster and it still amazes me how SSL just happens. Even just using certbot makes the job extremely simple.
There even are still some (shitty) webhosts that require payment for a TLS certificate, because they refuse to support letsencrypt.
And what is worse-
It wasn't cheap either! Some of the SSL cert providers were charging hundreds/thousands for a certificate!
The less evil ones, were still charging 30$ or so.
For cert-manager to work you need to have the ingress controller port (or I guess another port) exposed publicly? Or it supports DNS verification? I thought about doing this, but I am essentially having my cluster fully in a private network which I connect with wireguard from outside, but maybe I should reconsider?
I am keen to know a little bit more about your setup
Aha, yes that makes perfect sense. I remembered now that I checked some time ago and my DNS is not supported. But maybe I will move to acme-dns, it seems very hacky, I love it!
Every website I’ve ever set up has used letsencrypt, not sure where small business pages would be without it.
As a side note, how do people handle HTTPS with private networks (VPN or local) these days? I typically just stick to HTTP, but it would be nice to get rid of the warnings/lock (and I use HTTPS-only mode and firefox seems to require a fresh exception for every port).
I have a public DNS entry pointing to the local IP. And use DNS based verification to get the letsencrypt certificate.
DNS challenge, that way you don't have to have anything open to the outside. It needs to be using a domain you own and have registered, though.
Here's a tutorial with (seemingly) all the DNS providers: https://github.com/acmesh-official/acme.sh/wiki/dnsapi
Nice. I was using an older ddns that didn't support acme, but switched to a different that supports it so I'll look into it.
Self signed certificates and import CA onto all of my devices.
Or, public DNS with cloudflare that points to local IP, but you can't do this with a .local domain
Doing what the OP (same result, just different software) or I posted and assigning certificates to secure your local services means you can avoid the HTTPS warning that major browsers will pop up on an unsecure (HTTP) connection. Instead of going to an internal dns name without a certificate or direct to the ip....you assign a wildcard certificate to a domain name you've setup on your local dns. You then access that service via the HTTPS protected Domain name, with no warning.
There's also cloudflare tunnels
https://www.cloudflare.com/products/tunnel/
I use it for home assistant and it works great
This is the answer! I'm scared to open up my home network.
I also use this for my stuff. I don't have too open any inbound ports at all or worry about the fact that I'm on a dynamic IP, I just access things over my local IPs / hostnames as though I'm on my home LAN.
I used Techno Tim's guide on how to do essentially the same thing with different tools: Cloudflare, Let's Encrypt, Traefik, and PiHole (for my DNS)
https://www.youtube.com/watch?v=liV3c9m_OX8
https://docs.technotim.live/posts/traefik-portainer-ssl/
Have thought of doing this before. I only read halfway through but enough to confirm what I expected - too much work!
I can't open the link right now cause it seems to have gotten the hug of death, but if they didn't mention it check out Caddy. It handles the certificates all automatically. All you have to do is set up the DNS record and then point Caddy at your internal service and it handles the rest.
I'm using traefik and it does everything automatically
I unfortunately agree :( I wanted to use LE, but I really didn't want a bunch of extra infrastructure. I ended up ponying up for a domain cert. It was expensive, but it's really easy for all of my k8s Ingress/IngressRoute/HTTPProxy objects to use it.
The site appears to be down -- here's a link on the wayback machine: https://web.archive.org/web/20230606000957/https://blog.safewebbox.com/easily-encrypt-your-home-network-services-with-lets-encrypt/
Is there a lets-encrypt alternative that doesn't require you to pay for a domain? I'd like to use a local domain like myservice.home rather than myservice.domain.com. I currently have Caddy auto generate certificates for my services but it's a pain as some devices hate the self-signed certificate.
There might be a better way, but I have used free duckdns domain to generate lets encrypt cert. Im not even sure if that worked only because I had duckdns running on the same host
Self signed certificates. I have my services with a .local domain, created a 10year certificate. The only painful thing is that you have to import your CA into all of your devices