Hacker News Reader

Comment by andrewxdiamond | Hacker News Reader

“Not Self-signed” and “on the internet” are not the same thing.

You can get a cert for a domain that you only use on your intranet. The only public thing about it is the domain registration.

You can even use Lets Encrypt to get that cert for no cost. You just need to own a domain

View on HN

This is interesting to me. How would the DNS work without touching the internet? Or do you mean to say that only DNS touches the internet and rest of the site would be offline?

If I made some cool security-camera image-recognition project with YOLO and wanted to sell installs to my friends in the area, would I need touch their DNS settings too? Personally: I feel uncomfortable changing settings on other folk's routers. If I could get away with helping them set a static IP without touching anything else, I'd much prefer it.

The site can be served only within your local or private networks and use HTTPS. The certificate is issued using a DNS challenge, for a domain that you own.

You can buy a domain, put public NS servers on it for the only purpose of doing Letsencrypt DNS validation. Hint: Create root and wildcard (eg domain.ca and *.domain.ca) so you aren't leaking internal DNS records (not that it matters much).

You run an internal DNS server (Pihole + unbound is my combo of choice) which becomes authoritative for your internal LAN.

You can have a local DNS server that tells computers on your network where to find intranet-hosted applications. I use my Pihole for that purpose, but you can set up a regular DNS server just as easily.

In my case, my router just has a setting for what DNS server to use, and I point it at my local DNS instead of 1.1.1.1 or whatever.

Reply on news.ycombinator.com