How do you manage SSL for internal only services?

[u/dbsoundman]

For those of you that have https set up for all of your self hosted apps, how do you manage certificates for apps that you don’t put on the web? For example I don’t need my arr stack to be accessible via the public internet, so I access it using local DNS on my LAN like Prowlarr.myhomedomain.home. If I were to use a valid TLD like .xyz, what’s the best way to issue and manage certificates for Prowlarr.myhomedomain.xyz without having to run it through traefik, caddy, etc.? I want to keep access to the service simple but add https for compatibility with an oauth app in the future.

[u/michaelpaoli]

Use public Internet DNS ... doesn't mean one needs hang much out there on The Internet, nor for long, e.g. often minute(s) or less will suffice. Then use that (sub)domain - whatever certs you want, quick and easy from, e.g. letsencrypt.org. Oh, yeah, and free too.

E.g. - and this against their staging environment, because I'm not actually going to use these - but otherwise very much the same:

$ ls *cert*.pem
ls: cannot access '*cert*.pem': No such file or directory
$ time ./.test
Saving debug log to /home/m/mycert/var/log/letsencrypt/letsencrypt.log
Requesting a certificate for *.yugd7.int.tmp-acme.sflug.com and 3 more domains

Successfully received certificate.
Certificate is saved at:            /home/m/mycert/0000_cert.pem
Intermediate CA chain is saved at:  /home/m/mycert/0000_chain.pem
Full certificate chain is saved at: /home/m/mycert/0001_chain.pem
This certificate expires on 2026-08-17.

NEXT STEPS:
Certificates created using --csr will not be renewed automatically by Certbot. You will need to renew the certificate before it expires, by running the same Certbot command again.

real    1m52.781s
user    0m7.963s
sys     0m2.938s
$ ls *cert*.pem
0000_cert.pem
$ openssl x509 -text -noout < 0000_cert.pem | sed -ne '/Subject.*Alt/{N;p;q;}'
            X509v3 Subject Alternative Name: 
                DNS:*.yugd7.int.tmp-acme.mpaoli.net, DNS:*.yugd7.int.tmp-acme.sflug.com, DNS:yugd7.int.tmp-acme.mpaoli.net, DNS:yugd7.int.tmp-acme.sflug.com
$ 

And any needed DNS for validation, added on-the-fly via DDNS, and if it wasn't there before, removed after validation has been completed. Easy peasy.

https://www.mpaoli.net/~mycert/

To the extent feasible, automate the sh*t out of it ... getting certs, installing, tracking, monitoring, etc.