Obtaining valid SSL certs for internal network websites, WITHOUT opening any Firewall ports? reddit / selfhosted ---------------------------------------------------------------------- Fuck_Birches · 2023-11-03 20:48 Background: Currently running PFsense as my firewall and wanting to run a self hosted instance of BitWarden internally. The problem is that BitWarden kinda requires legitimate SSL certificates. Possible solution: It looks like HaProxy + ACME (Let's Encrypt) may work, but I think this route requires obtaining a DNS name? Are there other ways to obtain valid SSL certs for my internal network websites, without opening any firewall ports nor purchasing/requiring WAN DNS names? ---------------------------------------------------------------------- [deleted] · 2023-11-03 20:59 Yes very easy, by using the Lets Encrypt dns01-challenge instead of http01-challenge. Whatever software you use to get the certs must support it, and it must support the DNS provider of the domain. Most reverse proxies support it. **Simple enough to just search this sub.** > requires obtaining a DNS name? Yes, isnt that obvious? You cannot get any LE cert without a valid domain. It can be a free subdomain from www.duckdns.org or www.dedyn.io for example, doesnt need to be a paid "full" domain. But it needs to be real. And you cannot get them for IPs. So simply get yourself something like `example.duckdns.org` and set your reverse proxy to get a wildcard cert for `*.example.duckdns.org` and then you can use that cert for whatever services you want in your own network, like `portainer.example.duckdns.org` and `whatever.example.duckdns.org` etc and you dont need to open a single port for any of that. ---------------------------------------------------------------------- clintkev251 · 2023-11-03 21:00 If you don’t have a valid domain you’re not going to be able to have a publicly trusted cert. Best you can do is self sign, the ensure that all your devices trust your CA ---------------------------------------------------------------------- Pieterv24 · 2023-11-03 21:03 You can create your own self signed certs. When doing this you have to create your own CA cert. This CA cert needs to then be imported as a trusted CA on all the machines you want accessing your internal server. As far as i know this is the only way to do this that does not require domain ownership or any outward connection. This seems like a decent guide (only quickly scanned it) https://devopscube.com/create-self-signed-certificates-openssl/ ---------------------------------------------------------------------- thekrautboy · 2023-11-03 21:04 I would assume by OP saying "valid certs" they mean trusted by most devices without having to add their own CA. ---------------------------------------------------------------------- Pieterv24 · 2023-11-03 21:05 An addition. All self signed certs are valid ones. Just not trusted. This is why you need to add your ca to your machines to make them trust the cert. As far as I know, no trusted ca will sign a ssl cert without your prove of ownership of the domain ---------------------------------------------------------------------- Pieterv24 · 2023-11-03 21:06 Agreed. However as far as i know this is impossible with their restrictions. If they dont want to buy a domain this is the only way ---------------------------------------------------------------------- thekrautboy · 2023-11-03 21:07 No, valid Lets Encrypt works with things like a free subdomain too. ---------------------------------------------------------------------- SagaciousZed · 2023-11-03 21:09 I run Vaultwarden behind a caddy reverse proxy using [local\_certs](https://caddyserver.com/docs/caddyfile/options#local- certs). If you don't configure caddy to use another CA, it will act as one and you just need to import the generated root.crt on your clients. ---------------------------------------------------------------------- Pieterv24 · 2023-11-03 21:14 Fair. But youll still need control of some subdomain and a way to show ownership ---------------------------------------------------------------------- skc5 · 2023-11-03 21:17 Let’s encrypt is for public certs, or supposed to be anyway. You could use one of the dns plugins for certbot (I use route53) to validate instead of having to open a port. ---------------------------------------------------------------------- thekrautboy · 2023-11-03 21:25 Of course, but thats not really a problem with Lets Encrypt. ---------------------------------------------------------------------- tschloss · 2023-11-03 21:26 But doesn’t this require to add the token to your DNS records which usually some API connection? Or does the OP mean just inbound portforwardings when saying „open ports“? I hate this usage btw. ---------------------------------------------------------------------- skc5 · 2023-11-03 21:28 Yeah inbound ports are the dangerous ones. Outbound connections are usually fine. You add an entry to your domain, certbot checks for the entry to prove you own the domain. Pretty standard practice. ---------------------------------------------------------------------- Mezutelni · 2023-11-03 21:37 IT is if you are running some custom TLD only for company usage. You need DNS challange to show ownership of domain without opening port, and you can't proof ownership of domain that you don't actually own and controll. ---------------------------------------------------------------------- thekrautboy · 2023-11-03 22:16 Yes but thats not really the scenario here is it? ---------------------------------------------------------------------- hslatman · 2023-11-03 22:17 You could try step-ca, which lets you use a “private Let’s Encrypt” on you own network: https://smallstep.com/docs/step-ca/acme-basics ---------------------------------------------------------------------- thekrautboy · 2023-11-03 22:21 > But doesn’t this require to add the token to your DNS records which usually some API connection? Correct. Most tools like reverse proxies (Traefik, Caddy, NPM, etc) and things like certbot, lego etc support a variety of DNS providers like Cloudflare, Namecheap, DeSEC etc, so that API connection isnt a problem at all, its builtin. But the service that OP wants to use the cert for doesnt have to be reachable from the outside. Not even the reverse proxy, or certbot, or whatever tool is used, needs to open a port. Sure a internet connection is required. Technically after acquiring the cert OP could move the files to a machine that is completely offline and use them there. But that would probably only work for some time because then other machines in their network have no way to check on things like revoked certs etc, best case it works until the certs expires (90 days with LE) and then they have to re-do this again. Realistically when OP says "without internet" i believe they mean internet is present, but they dont want to open any ports and host anything to the public. They just want to use the certs internally. And with the dns01-challenge from LE that is possible. ---------------------------------------------------------------------- Mezutelni · 2023-11-03 22:36 That's literally the scenario here, op said that they don't own dns name, so they can't obtain valid SSL cert from trusted CA ---------------------------------------------------------------------- speculatrix · 2023-11-03 22:40 You can use dns to validate a letsencrypt wildcard certificate. So I have *.home.example.co.uk and then all my internal websites have valid https certificates. This is so much better than self signed certs. Of course, you do need your own domain, and be able to set txt records in the zone file at your dns provider. ---------------------------------------------------------------------- thekrautboy · 2023-11-03 22:49 Thats not the same as running a internal TLD for company intranet. ---------------------------------------------------------------------- revereddesecration · 2023-11-03 23:45 https://hub.docker.com/r/smallstep/step-ca https://warlord0blog.wordpress.com/2021/01/15/step-ca-and-acme/ Some links ---------------------------------------------------------------------- fortisvita · 2023-11-03 23:49 Here you go: https://youtu.be/qlcVx-k-02E?si=Yz2XpyfqfRlOnAaQ ---------------------------------------------------------------------- yashaskm11 · 2023-11-04 00:19 https://github.com/dani-garcia/vaultwarden/wiki/Running-a-private- vaultwarden-instance-with-Let%27s-Encrypt-certs ---------------------------------------------------------------------- MasterChiefmas · 2023-11-04 01:45 It is if they want to get a cert from a trusted CA, which is essentially what the OP is asking for. Just because you can set your internal DNS and TLD to whatever you want, doesn't mean you can get a cert issued to that domain that other things will trust without installing a CA cert. ---------------------------------------------------------------------- thekrautboy · 2023-11-04 01:48 > Just because you can set your internal DNS and TLD to whatever you want, doesn't mean you can get a cert issued to that domain that other things will trust without installing a CA cert. I never said otherwise? ---------------------------------------------------------------------- MasterChiefmas · 2023-11-04 01:59 >I never said otherwise? Ah I see, apologies. The thread's a bit messy, I thought your comment, with your other comments was sounding like you are saying you could just name your internal domain whatever TLD, and Lets Encrypt would respect that as valid ownership and issue a cert. ---------------------------------------------------------------------- thekrautboy · 2023-11-04 02:00 No problem. ---------------------------------------------------------------------- ithilelda · 2023-11-04 04:08 short answer: no. a so called valid cert is a cert issued by known certificate authorities (ca) preinstalled on the system, and all of them requires you owning the dns. on the other hand, you can create and install your own ca onto your own devices, and certs issued by yourself would be considered valid. there is no need to use anything other than openssl for that job. just google it and you'll find thousands of answers. ---------------------------------------------------------------------- thundranos · 2023-11-04 06:07 I use a small step certificate server internally. Works awesome. ---------------------------------------------------------------------- Keplair · 2023-11-04 07:24 Step-ca or Labca ---------------------------------------------------------------------- miscUser2134 · 2023-11-04 18:59 If you have PFsense, use the certificate manager to generate a Certificate Authority, install it on your machines that will access BitWarden, then generate a certificate under that Certificate Authority in PFsense and install in BitWarden. ---------------------------------------------------------------------- bufandatl · 2023-11-04 20:11 Create your own PKI and have certificates signed by it for your services and distribute the CA certificate to all clients in your network. ---------------------------------------------------------------------- treebeardd · 2023-11-05 01:45 I'd highly recommend buying a cheap domain. Maybe search around on namecheap until you find something.xyz for like $3. From there, one option is to buy a wildcard cert, eg. *.something.xyz and just use that on whatever host needs a cert. This is good because the cert is valid for a year. Another option is to an ACME service like let's encrypt or zerossl to get the certificate(s). I run rXg at the edge which makes it very easy to acquire certificates from either of those providers. I don't know if pfsense has the same capabilities. Once I have cert on the rXg, I just copy it + private key to the host that needs it and it's good for 90 days. There is a Free rXg program if you want to try self hosting your own edge Router with a zillion other features. Rgnets.com I'd generally not recommend setting up your own CA for this kind of thing, that seems painful. ---------------------------------------------------------------------- Palleri · 2023-11-05 07:34 Hi, I am the author of [LocalCA](https://github.com/Palleri/localca- buildv2) An easy selfsigned CA with a webgui deployed with Docker.