97

Many companies have intranet websites that are not reachable via the internet. Usually they just use a self-signed certificate, which causes a bad habit for the users since they get used to just pressing OK on invalid CERT warnings.

Question: How can they generate a certificate for their HTTPS websites using Let's Encrypt? Does the LTS web browsers have the Let's Encrypt as CA?

Isn't it a privacy issue that private domain names, like my-company-private-intranet-site.com, could be leaked?

  • 28
    Employees should be taught to import the company's self signed cert into their browser's trusted store. So that bad habits of clicking OK on websites don't develop. – RoraΖ Oct 23 '15 at 16:17
  • @LoukiosValentine79 Can you clarify what sort of extra attention you're looking for? I think the top-voted existing answer is already complete and correct. – drewbenn Apr 21 '16 at 18:08
  • 2
    I agree with @RoraZ if it is their computer and they have to remotely connect via the VPN. But if it is a computer at the office we generate a self signed root CA to trust our certificates, import it into the trusted store on their machine, and our employees interact with it like any other HTTPS site. Our employees are also less technical. It is wasted breath to try and talk them through the process. – Bacon Brad Apr 21 '16 at 18:34
  • 1
    And furthermore why are you using a public facing domain for a private facing website? Not only is it unnecessary but you are potentially routing internal traffic externally depending on your network/firewall/dns configuration. – Bacon Brad Apr 22 '16 at 1:29
  • 5
    I'm a little shocked by RoraZ's suggestion. You don't want users installing their own certs. Begging for disaster there. – Matthew Apr 3 '17 at 13:12
96
+50

Let's Encrypt can only issue certificates for valid DNS names. So if your intranet uses a made-up domain name like intranet.mycompany.local then it won't work.

If you have a real DNS name like intranet.mycompany.com (even if it doesn't resolve externally to your intranet), then you can use Let's Encrypt to issue certificates for it. If the domain does resolve externally to a server that can respond on port 80 (which need not actually be part of your intranet, if you have split-horizon DNS), you can use the http-01 challenge.

Alternatively, you can use the dns-01 challenge (fully supported in Certbot 0.10.0 and later, as well as other clients such as dehydrated, getssl and acme.sh). Since this challenge works by provisioning DNS TXT records, you don't ever need to point an A record at a public IP address.

So your intranet does not need to be reachable from the Internet, but your domain name does need to exist in the public DNS under your control.

Let's Encrypt - and publicly trusted certificate authorities in general, due to Chrome's requirements - submit all issued certificates to public certificate transparency logs. As such, you should not expect your intranet (sub)domain name to remain secret if you obtain a certificate for it. Your intranet's security shouldn't be dependent on keeping its domain name secret anyway.

  • You would need to at least briefly allow it to resolve… – Ángel Apr 25 '16 at 21:15
  • 6
    Not if you use the dns-01 challenge. – John Morahan Apr 26 '16 at 7:32
  • 20
    If your intranet security depends on its domain name being a secret, then you have a much bigger homework to do. – Lie Ryan Dec 22 '16 at 2:13
  • 1
    I didn't think I was implying otherwise, but the upvotes on your comment have convinced me I was wrong :) So, edited. – John Morahan Dec 17 '17 at 0:16
31

If you are looking for a internal CA-like service for an Intranet, then a public CA like Lets Encrypt may not work, as it want to connect back to its servers to manage the cert request and signing. This assumes you do not have internet access out from your intranet web server; you need to install a client on the webserver for it to communicate with the Lets Encrypt service.

How can they generate a CERT for their HTTPS website using Let's Encrypt?

LE has a dedicated client for this purpose. See How it Works

Does the LTS webbrowsers have the Let's Encrypt as CA?

There is limited support for browser ready CA root certs; see https://github.com/letsencrypt/letsencrypt#disclaimer. They do have public certs on the site at https://letsencrypt.org/certificates/

Let's get back to your main point, which was the issuance of browser accepted SSL certs that do not generate warnings. As RoraZ suggests you need to have users import the company's self signed cert to eliminate the recurring browser warnings, and prevent users developing habit of simply accepting invalid certificates.

We use OpenSSL to allow us to function as our own certificate authority, generating a root CA that all users must import, thereby allowing us to generate any additional certs that will automatically be accepted by all employees browser, or any service that rely on SSL. This is different than simply importing the self-signed cert as needed; you are actually creating a root CA certificate, and importing it. Going forward, you can issue any number of certificates for different common names, signed by this CA, and they are valid and trusted via your own private root certificate authority.

For creating and managing your own certificate authority, See http://www.flatmtn.com/article/setting-openssl-create-certificates

  • Thanks, this is a great answer. Could you quickly cover the main points of importing a certificate into a browser? I assume it may be different for Linux and Windows systems. My guess is that on Linux it would occur at the system level rather than browser. – r0berts Jan 23 '17 at 9:00
  • 1
    Ah good question. I prefer to place the final cert file in the root document folder, so that you can simply send a link to coworkers EG example.com/myrootca.crt. On Windows you just open the link in the browser and follow import prompts. For Linux it's a bit different. See unix.stackexchange.com/questions/90450/… – Rodrigo M Jan 29 '17 at 13:50
12

UPDATE 2019-03-30: Somebody actually found a large scale way of doing LE for internal servers: https://blog.heckel.xyz/2018/08/05/issuing-lets-encrypt-certificates-for-65000-internal-servers/

——————-

How can they generate a CERT for their HTTPS website using Let's Encrypt?

Not at all. This is for publicly reachable sites only.

(Update 2016-04-22: Maybe "not at all" is a little too hard. Here's a little more detail: LE is tailored to publicly reachable sites. You need some server that answers to the DNS name when LE comes asking. Now if you have configured your DNS server to give different answers depending on who is actually asking the question -- somebody from the inside or from the outside aka Split-Brain-DNS -- then you can redirect the verification request to any host that you want. -- But this is not a use case that LE really helps you with. On the contrary: In 2015, there was this explicit intention: "we plan to frequently change the set of IPs from which we validate". -- So that pretty much makes it impossible for you to just whitelist the IPs for the LE-validation-hosts on your firewall because these IPs may frequently change.

Does the LTS webbrowsers have the Let's Encrypt as CA?

Yes. Their CA is cross signed by a well known, well established CA. (Namely by IdenTrust.) So all clients that trust that old CA will also trust the new Let's-Encrypt CA right away.

  • @techraf: yes. But if in order to get the cert you have to make the site public, even if briefly, then I will answer "nope" to the question "Can I get a cert for an unreachable site?" -- And this is the same thing that the commenter in the link said: "private names can still get certs with ACME if they are public at the time of validation" -- I don't know if LE already allows DNS-only application. Then you could get around that. Even though I think your supposedly private DNS name would still end up in public Certificate Transparency logs. – StackzOfZtuff Apr 22 '16 at 6:09
  • @techraf: I agree. I works. But I think this is a hack. LE is not tailored to do this. Will change my post to accordingly. – StackzOfZtuff Apr 22 '16 at 6:24
  • @techraf: updated. Also: I like John Morahan's answer regarding this. – StackzOfZtuff Apr 22 '16 at 6:47
  • 1
    You don't necessarily need fancy DNS configuration to answer differently based on who is asking. If you configure your intranet VPN to favour internal DNS, that's configured to point to the real intranet, over the regular external DNS, that's normally run by your registrar configured to point to a publicly accessible server you trust to process domain verification, then you can pass the domain control verification, and then you can transfer the certificate over to your intranet. – Lie Ryan Apr 22 '16 at 12:33
1

For a proper solution you can run an own boulder instance, i.e. the letsencrypt server part, on your network. Then you can use all official and inofficial clients with your own ACME-Server if they support using different ACME urls (the official ones do, for others you need to look it up in their documentation or source code).

Then you need to import the CA certificate in the trust store of the clients using your servers.

If you're only having a few servers running boulder and "letsencrypt" yourself is probably not the best choice and you can use more simple tools like easy rsa.

0

So long as you own the real domains and don't want one for domains like localhost or internal network IP's, you could generate one on the public internet, pointing to a blank system, then transfer it to your intranet using rsync or similar.

You can even now apparently get a wildcard, so *.internal.yoursite.extension could work. It is obviously useless for spoofing sites like microsoft.com.

I Can understand why spoofing sites is undesirable, but I can also see how it can be useful to not have to install CA's on every workstation in the org.

  • 1
    Last label of a domain name is not an "extension". It is a TLD. Please use RFC2606 next time you want to do some obfuscation. – Patrick Mevzek Apr 13 '18 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.