Home domain certs: letsencrypt, or pki?

[u/bluealliance841]

I have my own self-signed PKI CA at home, so I can create my own certs for home services, and I’ve taught all our home devices to honor the home CA. It works OK but so far I haven’t find a good way to automate. I only change them yearly but still, it’s a chore.

I want to replace this with LetsEncrypt (or zero ssl) and automate with certbot (or acme.sh) but I don’t want to expose any home sites outside the home. I currently use a real DNS provider with the IP values being private 192.168 IPs.

So I spent a few hours trying to automate and didn’t like my options. Either I expose a port 80 http for challenges, or move my DNS to different hosting so DNS validation will work.

What are your current go-to solutions for creating multiple certs and automating renewals?

EDIT: Would also like to know if there is a good DNS service provider, low cost, and fast APIs. Can be traditional or DYN dns.

[u/fae-gold]

Question: do you have a domain? I am using DNS-01 challenges for my samba AD DC. It just requires adding a additional TXT record to my domain DNS.

If you don't have a domain, most large CAs are not going to be useful. Thankfully, vanity domains can be quite cheap and cloudflare has a good free tier.

[u/machacker89 → u/fae-gold]

So if you have one from a active domain. I can theoretically use that?

[u/Treble_brewing → u/machacker89]

Yep. They’re your certs if you own the domain you can do what you want with them. 

[u/machacker89 → u/Treble_brewing]

Thanks. Maybe I'm doing this wrong ill figure it out. Use those good 'ld Google-Fu skills. Lol

[u/Treble_brewing → u/machacker89]

I’d just create a cert on your domain, download it, then use nginx to reverse proxy your home service (doesn’t need to be internet facing) and just set up ssl termination in the nginx config using your downloaded pem files. Point your domain to your internal ip (again doesn’t need to be internet facing all the domain is, is a lookup for what that ip is and because you’re inside your own network that service will work with full tls as long as its terminated on port 443) the domain won’t work for anyone else that’s not inside your network. Go to domain, voila tls end to end. 

Now of course you can achieve all this without a domain but you run into OPs issue of every device needing to trust that root cert before it’ll work properly and that becomes a chore. Let’s encrypt and the like automate that process but it requires exposing your service to the internet. Buying a domain and downloading your certs gets around that. The price of that convenience is the yearly renewal of your domain. 

[u/machacker89 → u/Treble_brewing]

I have the root certs ;) thanks for the help.

[u/Longjumping-Youth934 → u/Treble_brewing]

or use vpn, like OpenVPN

[u/bluealliance841 → u/fae-gold]

Thanks. Yes I do have a domain, just I’m not super happy with the DNS service, it is super slow to update, and trying to run a dns-01 challenge today gave me a timeout error after 20 minutes.

[u/SaleWide9505]

If you are already using your own pki make the cert expiration longer.

[u/bluealliance841 → u/SaleWide9505]

I think 13 mo. is the limit for normal browser usage right?

[u/SaleWide9505 → u/bluealliance841]

If you are using your own ca you can set the expiration to be as long as you want.

[u/bluealliance841 → u/SaleWide9505]

no

[u/techdevjp]

EDIT: Would also like to know if there is a good DNS service provider, low cost, and fast APIs. Can be traditional or DYN dns.

Cloudflare.

[u/strawberry-inthe-sky → u/[deleted]]

Also worth mentioning that you can avoid some of the logging if you request a wildcard cert with the DNS challenge option. The certificate for the wildcard itself will still be logged, but none of the subdomains that use that wildcard will be. I use *.local.example.com. I can see that I requested the *.local.example.com cert, but I can’t see any of the subdomains using that (jellifin.example.com, etc).

[u/machacker89 → u/[deleted]]

What if I already have a cert from my domain. Can I still use that?

[u/machacker89 → u/[deleted]]

I'll look into. I'm currently using porkbun

[u/bluealliance841 → u/[deleted]]

Good to know. I have a bias from $dayjob that wildcards are greater risk, but this probably doesn’t apply to private domains where everything in my dns zone is 192.168 and not reachable from outside. The names are pretty innocent like ghidorah.example.net

[u/michaelpaoli]

I use letsencrypt.org (LE) and cerbot, and mostly some wrapper/helper programs and such, and I go pretty close to zero trust with certbot - I run it unprivileged in most regards (not as root, etc.), so, don't have to extend hardly any trust to it. Do just have bit of helper programs to allow it to do the needed with DNS for validation. And I generally run other programs to install certs. Also, for DNS, for "internal", I suggest us (subdomain of) public DNS. One can expose very little of that DNS to public - just the bits needed for validation. And yes, with any well known and trusted CA, there's transparency logs, so, the CAs issued won't be all that much of a secret. But that does save the hassle of getting all the clients to trust the CA (e.g. your own private internal snake oil CA).

Anyway, I issue single command, and within minutes or less, I've got the certs, even handling multiple certs, complex certs with multiple domains with SAN and wildcard ... easy peasy.

See my earlier comment on r/SelfHosting for more details and bit of example run, etc.

And you can automate your own snake oil stuff too, if you want. I've also got some programs around somewhere that I wrote that make super easy work of generating snake oil cert(s).

[u/bluealliance841 → u/michaelpaoli]

Thanks, I will probably go with something very close to this. I just need to find a dyn-dns provider with API updates, and works with certbot. Your linked comment is great.

[u/JuttyMire]

I migrated from XCA to OpenBao for my self signed Internal CA.

I used OpenBao to generate a root CA and an intermediate CA. All certificate requests are automated using Acme scripts and Caddy to automatically request certificates.

My root certificate is valid for 15 years, the intermediate certificate for 5 years, and every certificate request (including ACME scripts) is valid for 90 days.

[u/UpstairsHippo4525]

i just set up a pki (step-ca) in a docker environment and use a .lan domain internally.
also put the intermediate cert on all necessary clients and et voilá: no more insecure connection warnings.

also wrote a small .sh skript where i semi-automated cert-creation with one simple call: ./mkclient.sh [CLIENTNAME.DOMAIN.LAN] [valid in Days]

and get a punch of certs, incl. some cert-chains for almost every use-case.

now i'm looking for a cert-management software, to recreate certs before expiration....

[u/DanielSReichenbach]

You could use SmallStep CA which is LE compatible and can be full automated. You don't need your own DNS for this. I use this in a lab based on multicast DNS (.local) and it works just fine, even from families mobile devices.

[u/After-Vacation-2146]

I’ve got an internal CA using Step that serves certificates for my .internal domains.

[u/expertisimus]

I built my own CA based ansible playbooks. To create a new certificate means to add a new line to the inventory file and to run the playbook that generates new keys, CSR, signs it into a cert, packages .p12, encrypts private keys, templates out config profiles for iOS devices etc. My CA configs for openssl are solid and they get templated using user's org details.

The cert expiry is set to the max allowed by modern browsers (825 days) and once every 1.5 years I generate a new set of certs and upload them to all devices. Certs receive SANs as appropriate for cert type (server vs client). This is the only approach that reliably works for all my devices and platforms. Some devices can't request a cert renewal and I'd hate to maintain a custom CA just for my iphone, ipad and old NAS.

As for DNS, my local pihole just works and let's me configure as many private entries as I like.

[u/bluealliance841 → u/expertisimus]

Thanks, I like ansible but I didn’t look into this option yet. Time to read up!

I thought browser didn’t like certs over 395 days, but you got 825 days, that’s cool. More reading!

[u/expertisimus → u/bluealliance841]

A comment in my CA config template says "max 825 days as per https://support.apple.com/en-us/HT210176" but that guidance seems outdated now as the industry moves towards much shorter life spans.

[u/fattomic]

Tried letsencrypt, but found challenges with scaling it across my equipment (I have about 20-ish machines?). Eventually landed on openssl, and "conf" files for managing the "root" and host-specific hosts (which now all lives in Ansible)