6 ms·

For local services, I don't see the benefit of using DNS challenges and a Let's Encrypt certificate over running my own CA and generating my own certificates. I

For local services, I don't see the benefit of using DNS challenges and a Let's Encrypt certificate over running my own CA and generating my own certificates. It's not that much work to trust my root certificate on each device, and then I don't need an internet connection to verify local service certificates.

sebiw 7mo ago
> It's not that much work to trust my root certificate on each device Sure, but is trusting your homebrewed CA on all your devices for essentially everything really a good idea? When your homebrewed CA somehow gets compromised, all your devices are effectively compromised and not only for local connections, but everything that uses PKIX.
- NewJazz 7mo ago
  Name constraints https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-constraints.html https://systemoverlord.com/2020/06/14/private-ca-with-x-509-...
  - 8organicbits 7mo ago
    Make sure all the TLS clients you use have support for name constraints. When I evaluated this in 2023, Chrome was in the process of adding support. I'd love to see a caniuse style analysis of TLS features, people assume they work but support varies.
Hamuko 7mo ago
I can either add a Cloudflare API key and Certbot on my NAS, or I could generate a root certificate and add it to my desktop computers, laptop, tablet, phones, Apple TV, etc. Doesn't seem that tough of a choice. I guess in the future I could even forego the Cloudflare API key and just have the persistent DNS record there once.