Let's Encrypt privacy concerns for private networks
Let's Encrypt privacy concerns for private networks
I vaguely remember reading something about leaking your private network setup if you used Let's Encrypt to generate your certificates.
Because of this when I installed my reverse proxy with caddy to handle my selfhosted home network I configured it to generate the certificates locally.
But this comes with the issue of the annoying warnings of the browsers plus being unable to connect to those devices/services which can't ignore it.
Am I being too paranoid? Is there any real concern about generating the certificates with Let's Encrypt for addresses which I don't intend to have outside my private network?
I don't see why you couldn't just get a wildcard certificate that doesn't include any hostnames, if you handle your traffic on a single Caddy reverse proxy anyways.
Yeah, solution is just to get a wildcard cert.
Ah, got it!
I'll look into it, AFAIK caddy autogenerates all certs for each site, so probably I'll have to manually create and import the wildcard one.
I wrote about the problems last year
https://shkspr.mobi/blog/2022/01/should-you-use-lets-encrypt-for-internal-hostnames/
Wildcard cert both solves that, and makes life easier since you just have 1 cert for everything.
... in case you don't know: if it's for resources on a private home network, you can easily add the CA cert (i.e. the public key associated with the private key used to sign your certs) to your devices so that it's no longer unknown and the warnings disappear. I know this doesn't answer your question, but it's what I'd do instead of using letsencrypt for private services.
Depends on your risk profile, really. It'll technically leak out the DNS name your using internally in order to generate the cert. But, to get a cert from anything (if not wildcard) you'll have to do this if you don't want to spin up your own CA.
It leaks the names of your domains since info about all certificates are published. If that matters too you, a simple solution is to only generate and use a wildcard certificate (*.domain.tld).