-1

For my personal use, I bought a domain for internal ssl validation for my pfsense. I was able to get the LetsEncrypt's ACME script to successfully validate my domain and produce an ssl certificate for a subdomain. I setup my pfsense to use my new certificate and alternative host name successfully.

So far, everything was going according to my expectations. Since I am using a windows server to run my DNS server (was forced to), I expected to setup a route on the DNS server to point to my pfsense's IP. To my surprise, before making any further changes, when I tested my new subdomain, everything was working. I confirmed pfsense wasn't running a DNS server and my computer's network's DNS was set to my Windows DNS server.

How is it possible that by navigating to my new subdomain that it correctly links with my pfsense's ip? Would this be true for all certificates I create via LetsEncrypt's ACME scripts?

4
  • 1
    Why should it link with your pfsense IP in the first place? The certificate you got is not associated with an IP address but with a domain name only. It does not matter for the certificate issuer what the relation between the domain name and a specific IP address is in DNS for this and the DNS-01 validation does not require access to the server running the domain either. Jul 16, 2021 at 5:04
  • I would all ways reach my pfsense by navigating to 192.168.20.1 . Now, just by navigating to random.domain.com, it shows me my pfsense. Sure, I created random.domain.com ssl but I never specified any ip to it. Doesn't DNS need to resolve any url to an ip before the browser can view the end result?
    – SILENT
    Jul 16, 2021 at 9:35
  • 4
    I have no idea what you are doing here actually since too much details of what your are doing and of your setup are missing. But of course a browser need to resolve a domain in the URI before it can access the domain. This does not need to be in the global DNS too, i.e. there can be local configurations on your system, in the DNS server you use (pfsense?) etc. And none of this has anything to do with the certificate or with letsencrypt. Jul 16, 2021 at 10:29
  • @SteffenUllrich What details would you like to know? 1. I used to access my pfsense via 192.168.20.1 2. I created an ssl certificate linked to random.domain.com. It was set on my pfsense. random.domain.com is an A record to my static external IP. I only mention the ssl certificate because before linking random.domain.com to the ssl, navigating to random.domain.com did not resolve to 192.168.20.1. 3. How does navigating to random.domain.com resolve to 192.168.20.1?
    – SILENT
    Jul 16, 2021 at 19:28

2 Answers 2

0

Let's Encrypt does domain base validation (so called DV certificates) so the only thing they vouch for and which is in the certificate is that at the time of issuance of the certificate you were able to prove you own a specific domain (including the case of a wildcard) through one of possible means (DNS-01 being one, HTTP-01 being another for the most known ones).

For the DNS-01 validation, the CA just verified you were able to enter in the zone some arbitrary content proving you control the content of the zone (there is a slight leap of feath here between "owning the domain" and "controlling the zone" but that is outside of the discussion here), which is enough to issue the certificate.

At no time do IP addresses have a role in all of this. Once the certificate is issued you are free to use it on any server you want, at any location (IP address you want).

Aside, you can have IP addresses in certificates, hence having a CA vouching that at a given time you were able to assess control on a specific IP address. But specially for HTTPS, those certificates are not very useful outside of rare cases (https://1.1.1.1/ being one).

1
  • I would all ways reach my pfsense by navigating to 192.168.20.1 . Now, just by navigating to random.domain.com, it shows me my pfsense. Sure, I created random.domain.com ssl but I never specified any ip to it. Doesn't DNS need to resolve any url to an ip before the browser can view the end result?
    – SILENT
    Jul 16, 2021 at 9:35
0

I'm unclear why it worked initially and then stopped but I figured out the flow. The local DNS server needs an A record to point to the subdomain to ip.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .