2

Over time my home network accumulated quite some devices which run web interfaces. They are accessed only locally, from within the home network.

What would be the best way to run them with https, while being able to access them with names, and not IPs. Self-signed certificates are not an option.

I came up with the following idea:

  • Create names in the zone home.myown.tld in the public DNS of my myown.tld pointing to my local addresses, like server.home.myown.tld pointing to 192.168.x.y.
  • Create letsencrypt certificates for all the servers and devices

Is that a good approach or can it be done better?

Specifically: How bad is it to assign local addresses to a public domain name?

Improve this question
3
  • 1
    What do you want to secure your servers from?
    – schroeder ♦
    Apr 5, 2017 at 15:09
  • I don't think LE is an option for private IPs
    – schroeder ♦
    Apr 5, 2017 at 15:20
  • 2
    Host an internal DNS and CA server becomes a viable, if not clunky option
    – schroeder ♦
    Apr 5, 2017 at 15:21

2 Answers 2

Reset to default
1

Sure, this is a fine way to handle it. We've done the same thing at a previous job.

How bad is it to assign local addresses to a public domain name?

Just because you have publicly registered your domain name doesn't mean the DNS for it also needs to be public. You can only add records on a DNS server that runs on your local network, and that will prevent an attacker from using DNS to learn a bit of information about your network topology and services running.

Improve this answer
6
  • will letsencrypt work on private DNS names and IPs? I'm thinking no.
    – schroeder ♦
    Apr 5, 2017 at 15:20
  • Oh, good point (at least, it'd be difficult). You could buy a more traditional certificate though.
    – Xiong Chiamiov
    Apr 5, 2017 at 16:16
  • 1
    For only local access, though? I'm not sure that you can buy certs for private, internal domains.
    – schroeder ♦
    Apr 5, 2017 at 16:46
  • The domain can be external, you just only ever add records to an internal DNS server.
    – Xiong Chiamiov
    Apr 6, 2017 at 6:22
  • That is, you register example.com, have whatever skeleton of a public presence is necessary for your cert vendor of choice to give you a certificate for *.example.com, then add records to your internal DNS server for foo.example.com, bar.example.com, etc.
    – Xiong Chiamiov
    Apr 6, 2017 at 6:25
1

This would work, but I wouldn't recommend it as the NS records will reveal the internal network topology.

Instead why can't you use the local hostnames of the servers? Create a local CA, issue certificates to all host and add the CA as trusted CA on all the clients in your local domain.

Improve this answer
2
  • I would prefer to avoid creating a local CA, since it means importing that local certificate into all the browsers likely to connect to the service. That would be > 10 and counting for new devices/browsers.
    – yglodt
    Apr 5, 2017 at 18:33
  • 1
    You need not add the cert to all clients. Instead you can add it to the trusted credential store of each operating system. If the clients are windows systems, you can push the certificate centrally using the domain controller. I agree that it can also be tedious if the number of systems tend to increase. In that case, your solution would be a better choice.
    – hax
    Apr 5, 2017 at 18:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .