• dudeami0@lemmy.dudeami.winEnglish
      3·
      1 year ago

      Hard to believe you used to have to pay for a TLS certificate. I use Let’s Encrypt with cert-manager on my kubernetes cluster and it still amazes me how SSL just happens. Even just using certbot makes the job extremely simple.

      • sudneo@lemmy.worldEnglish
        2·
        1 year ago

        For cert-manager to work you need to have the ingress controller port (or I guess another port) exposed publicly? Or it supports DNS verification? I thought about doing this, but I am essentially having my cluster fully in a private network which I connect with wireguard from outside, but maybe I should reconsider?

        I am keen to know a little bit more about your setup

        • dudeami0@lemmy.dudeami.winEnglish
          1·
          1 year ago

          I am using cloudflare DNS, which cert-manager requires an API key to edit the DNS entries. Documentation on this can be found here. It seems to support a number of DNS APIs, you can view those here.

      • ActuallyRuben@actuallyruben.nlEnglish
        1·
        1 year ago

        There even are still some (shitty) webhosts that require payment for a TLS certificate, because they refuse to support letsencrypt.

    • Dav@kbin.social
      1·
      1 year ago

      Every website I’ve ever set up has used letsencrypt, not sure where small business pages would be without it.

  • vividspecter@lemmy.worldEnglish
    1·
    1 year ago

    As a side note, how do people handle HTTPS with private networks (VPN or local) these days? I typically just stick to HTTP, but it would be nice to get rid of the warnings/lock (and I use HTTPS-only mode and firefox seems to require a fresh exception for every port).

    • the_thunder_god@kbin.social
      2·
      1 year ago

      Doing what the OP (same result, just different software) or I posted and assigning certificates to secure your local services means you can avoid the HTTPS warning that major browsers will pop up on an unsecure (HTTP) connection. Instead of going to an internal dns name without a certificate or direct to the ip…you assign a wildcard certificate to a domain name you’ve setup on your local dns. You then access that service via the HTTPS protected Domain name, with no warning.

    • dustojnikhummer@lemmy.worldEnglish
      1·
      1 year ago

      Self signed certificates and import CA onto all of my devices.

      Or, public DNS with cloudflare that points to local IP, but you can’t do this with a .local domain

    • jargoggles@kbin.social
      1·
      1 year ago

      I also use this for my stuff. I don’t have too open any inbound ports at all or worry about the fact that I’m on a dynamic IP, I just access things over my local IPs / hostnames as though I’m on my home LAN.

    • plo@feddit.nlEnglish
      1·
      1 year ago

      This is the answer! I’m scared to open up my home network.

  • wheels@lemmy.worldEnglish
    1·
    1 year ago

    Have thought of doing this before. I only read halfway through but enough to confirm what I expected - too much work!

    • kamin@lemmy.kghorvath.comEnglish
      2·
      1 year ago

      I can’t open the link right now cause it seems to have gotten the hug of death, but if they didn’t mention it check out Caddy. It handles the certificates all automatically. All you have to do is set up the DNS record and then point Caddy at your internal service and it handles the rest.

  • Epsilon@kbin.social
    0·
    1 year ago

    Is there a lets-encrypt alternative that doesn’t require you to pay for a domain? I’d like to use a local domain like myservice.home rather than myservice.domain.com. I currently have Caddy auto generate certificates for my services but it’s a pain as some devices hate the self-signed certificate.

    • dustojnikhummer@lemmy.world
      01·
      1 year ago

      Self signed certificates. I have my services with a .local domain, created a 10year certificate. The only painful thing is that you have to import your CA into all of your devices