Hacker News Reader

Comment by 8organicbits | Hacker News Reader

The inability to get a TLS cert is an issue. I've been working on getlocalcert [1] as a free subdomain service for local networks. You get a valid domain, you can get a Let's Encrypt (or other ACME DNS-01 provider) cert. But you need to provide your own split DNS locally to resolve addresses. It's intended to fill the gap between paying for a domain or using a free domain service full of abuse.

Because you need to provide DNS locally, it's useless for the common abuse scenario (spam, phishing, illegal content). Unlike other free domain providers, I have never received an abuse notification.

I got on the public suffix list in the last few months. Lots more features I'd like to add, but my attention has been elsewhere.

[1] https://www.getlocalcert.net/

View on HN

I was just looking into this kind of thing for a training lab we stood up and maybe you could have some advice/clarification to offer me from working on this. We have a locally hosted external DNS which wildcards everything not otherwise specified to an authenticating web proxy (currently caddy and locally hosted coredns). It's not clear what the "lazy" way to get a wildcard DNS cert via ACME DNS challenge going is with this kind of set up. To me it feels like Caddy is missing a built in functionality to act as the delegated ACME DNS responder and it's not clear which option is the best way to get Caddy (normally very automatic) to reload after it handles the requests.

Not particularly bound to Caddy or Coredns on the external side but it's what we're using for the internal as well.

Are you trying to get the TLS cert for domains you own, or are you getting certs for all other domains?

For the former, the Caddy ACME DNS plugin should work.

For the latter, I think mitmproxy or similar would handle the on demand TLS cert creation. There's commercial intercept proxies as well, but I have no experience with them.

Just a *.ourpubliclabdomain.com cert. I'll look into ACME DNS + the Caddy plugin. Thanks!

Sign your own? It’s your home!

I've thought about running a local CA, but wouldn't one need to have all of their devices configured to trust the local CA in addition to issuing certs to your services? I've been getting by just clicking through the TLS warnings for my LAN services, most browsers remember the choice for a couple days at least.

I've been doing this for a while with SmallStep CA: https://github.com/smallstep/certificates

It's a bit of a pain to load a cert onto every device (easier with stuff like Ansible if you have a bunch of linux devices), but manageable. And it lets me do proper trusted TLS for a lot of stuff that would otherwise be self-signed.

edit: It's also just a fun homelab project to see what it's like to run a full production-ish PKI setup.

One thing I recommend is to add X509v3 Name Constraints extensions to your root CA if you go down this path. It prevents the CA from being abused to MITM you for other domains (at least for browsers/clients that respect names constraints)

  X509v3 Name Constraints: critical
      Permitted:
        DNS:home.arpa
        DNS:.home.arpa
        IP:10.0.0.0/255.0.0.0
        IP:172.16.0.0/255.240.0.0
        IP:192.168.0.0/255.255.0.0

At that point just buy a proper domain. That ought to be easier than setting up a custom CA.

it depends on your use case, but yes you would probably need to load at least your browser with your own CA. It’s a good hygiene to manage your own keys though

Reply on news.ycombinator.com