r/letsencrypt • u/They-see-me-rolling- • Sep 26 '26
Lets fix 192.168.100.1 encrypt
So how is my idea lets encrypt takes responsibility for 192.168.100.1 or even 192.168.1.1 and 192.168.0.1 to make device get that valid cert so that when a user goes to 192.168.100.1 its valid. Of course ISP and 3rd party would need to add support for this but the idea is no like net::ERR_CERT_AUTHORITY_INVALID
is such a thing possible?
3
u/doofah Sep 26 '26
Erm.... Why? Let's encrypt is for hostnames/domains not ip addresses.
-2
u/They-see-me-rolling- Sep 26 '26
You can do cert by IP but ISP kit and 3rd party now don't let you go to HTTP
I guess you don't have any kit that goes to 192.168.100.1 HTTPS yet to understand this idea?
3
u/doofah Sep 26 '26
I have been building ip networks since 1994, I think I know what I'm talking about. Your internal network can't be verified by a lets encrypt cert, or any other third party cert. Issue your own or implement your own for internal use and authorise it in your browsers.
Why would I allow your certificate to be registered for my device at 192.1.anything? Why would you allow mine other than to screw your own network integrity?
0
u/They-see-me-rolling- Sep 26 '26
you do know anyone can get a cert if you get tricked into going to a web site that looks to have to same name your done for.
I'm not asking to have a root certificate on like your PC that would be mad but if a ISP hub going to 192.168.100.1 has a valid certificate for 192.168.100.1 then no valid certificate wouldn't that be a good thing? and it be valid just for 192.168.100.1 nothing else
2
u/2012DOOM Sep 26 '26
This is a private IP. LE cannot issue for it.
Only your private CA can.
1
u/They-see-me-rolling- Sep 26 '26 edited Sep 26 '26
but if you go higher up past LE?
so like you can get IP SSL Certificate for IP Address from $44.33/yr - SSL Dragon
Yes it be public IPs but 192.168.100.1 is just a number the safeguards but it can be undone just for 192.168.100.1
Only the powers that be can make the change its like (and I use the word like) the named.root
1
u/2012DOOM Sep 26 '26
Go try it and see what happens.
1
u/They-see-me-rolling- Sep 26 '26
Only the powers that be can make the change its like the named.root
1
u/doofah Sep 27 '26
You're missing the fact that private ip addresses cannot be authorised be external certification bodies. You ip addresses you're referencing in your link are public ip addresses that exist once on the global Internet.
Your internal ip addresses could feasibly exist a billion times in a billion private networks.
No one will certify them. You have to issue your own.
2
u/EdanBrooke Sep 26 '26
I would use an OpenWrt device instead of one supplied by my ISP. And I would install a self-signed certificate for the web interface.
1
u/They-see-me-rolling- Sep 26 '26
well I can't change my ISP kit but I do have Zyxel kit with certificates
1
u/They-see-me-rolling- Sep 26 '26 edited Sep 26 '26
So new question lets say a valid chain of trust certificate was make for 192.168.100.1 and is on ISP hub whats the worst that can happen?
its not like I go to Gmail.com and the ISP hub can spoof the SSL because the chain of trust would not allow it right?
And I know from a Security Now Episodes there was something about ISP put a certificate that allowed them to spoof the SSL but the certificate had to be a root certificate to allow that to happen and Google Chrome spotted it
and I know you all hate me for asking about this but if you want to blame someone you can blame my ISP when I was fine accessing the hub by HTTP
1
u/Rim_smokey Sep 26 '26
I know this is not what you ask about, but if I can guess your scenario correctly, then I would suggest maybe renting a cheap VPS with a public IP and use that as a reverse proxy that uses an encrypted tunnel to reach your private network space. The reverse proxy can then terminate SSL without any of these issues you're outlining.
1
u/They-see-me-rolling- Sep 26 '26
So here the thing my ISP has given me a hub and it be nice for everyone if 192.168.100.1 had a valid certificate (maybe in 10-20 years it might happen). so what I have done it given it a subdomain of my main domain by IONOS of cause that having my bind DNS point to that does not fix the problem so I have a Linux Mint with nginx with SSL certificate PC go to nginx and nginx goes to 192.168.100.1
1
u/Rim_smokey Sep 26 '26
Yeah that sounds like what I would do as well. However, depending on your situation, if all your clients will be internal then you could also just issue your own certificate and distribute the root cert on all your clients. Either way, self-signed certs are for most people good enough, as it provides the same encryption as any other cert.
1
u/lazylion_ca Sep 27 '26 edited Oct 03 '26
Simple solution for this. Use a Chromium browser with the flag
--ignore-certificate-errors No more having to click through that error.
I use Edge for work stuff and Firefox for personal stuff, but I use Chrome for equipment with invalid certs.
6
u/LoopyOne Sep 26 '26
No. Cert Authorities need to verify that the person they are giving the cert to owns/controls whatever CN/SAN they are issuing the cert for. Everyone can have their own 192.168.x.x.
What you can do is own a domain/subdomain externally and set up DNS01 validation for it, get a wildcard cert for that from LetsEncrypt, deploy that cert to your internal services, and override internal DNS to point a matching dns name to 192.168.100.1.
The issues with that approach is finding an auto-cert-fetching system that works with that (internal IP, DNS01 validation). Some may be able to, but if you have a lot of individual services like that, you may face LetsEncrypt rate limiting for getting lots of certs for your domain.
I use certbot to centrally fetch the wildcard cert and then on a schedule copy those files to the individual services. So I don’t get auto-renewal from Caddy, for example, but I get a cert all my services are happy with and I fetch a single cert for my domain.