Is it a good idea to re-use tailscale certificates for local use?
reddit / selfhosted

----------------------------------------------------------------------
Significant-Neat7754 · 2023-11-03 03:14

My ISP has CGNAT and I use tailscale for tunneling.

I do not want to change the URL for each app or service I use on
remote devices based on whether they are connected to the tailscale
network. Is it a good idea to use the tailscale certificate generated
by the tailscale app locally within my network? This means creating a
virtual host using the Apache Web server that I use by asking Apache
to use the tailscale certificate.

That way I'll have access to HTTPS connectivity locally without having
to change the URL of services when I'm outside the network.

----------------------------------------------------------------------
nostril_spiders · 2023-11-03 10:05

How are you going to get the private key?

And isn't the certificate for a name in the tailscale DNS zone?

Basically, stuff you don't control.

I did not find it easy to set up certbot - it took me a full day. But
I'm personally happy that I did because I think it's a better
solution. I have a certbot container, an nginx container as a reverse
proxy, and a cheap domain.

This is on a single docker host with multiple IP addresses on the
single NIC. I have tailscale, also in a container doing subnet
routing.

If you're willing to dick about with it, LMK if you'd like some
ansible code or whatever. I doubt my code would just drop into your
network, but maybe it could give you a head start.

----------------------------------------------------------------------
Significant-Neat7754 · 2023-11-07 17:30

Thanks. Just one thing. Tailscale certificates (and keys) are
available locally using the \`tailscale certs\` command. So you can
definitely get the keys.