I vaguely remember reading something about leaking your private network setup if you used Let’s Encrypt to generate your certificates.
Because of this when I installed my reverse proxy with caddy to handle my selfhosted home network I configured it to generate the certificates locally.
But this comes with the issue of the annoying warnings of the browsers plus being unable to connect to those devices/services which can’t ignore it.
Am I being too paranoid? Is there any real concern about generating the certificates with Let’s Encrypt for addresses which I don’t intend to have outside my private network?
You must log in or register to comment.
Wildcard cert both solves that, and makes life easier since you just have 1 cert for everything.
… in case you don’t know: if it’s for resources on a private home network, you can easily add the CA cert (i.e. the public key associated with the private key used to sign your certs) to your devices so that it’s no longer unknown and the warnings disappear. I know this doesn’t answer your question, but it’s what I’d do instead of using letsencrypt for private services.
I don’t see why you couldn’t just get a wildcard certificate that doesn’t include any hostnames, if you handle your traffic on a single Caddy reverse proxy anyways.
It leaks the names of your domains since info about all certificates are published. If that matters too you, a simple solution is to only generate and use a wildcard certificate (*.domain.tld).
I wrote about the problems last year
https://shkspr.mobi/blog/2022/01/should-you-use-lets-encrypt-for-internal-hostnames/
Not sure what you mean? I don’t use Cloudflare as a CDN.
When I visit the link with JavaScript disabled I get blocked by a site stating “Please wait while your request is being verified…” and then nothing happens even though the actual site behind that screen displays fine without JavaScript.
Are you using a VPN? Can you share a screenshot? I don’t use CloudFlare, but my host does block users which are from IP addresses which have previously been used for abuse.
Tor Browser on Android. It happens on multiple circuits with different exits. Not an image by me, but it looks like this: https://global.discourse-cdn.com/cloudflare/original/3X/c/3/c38eaed81c96ac19e4fd5a69d4257445b391927e.png
I don’t support TOR, sorry. I got to much abuse from it and its users.
