Embed Notice

@selea
Free signage solution? Like TLS certificates for https traffic or vpn?

Simple offline solution: openssl and a bunch of shellscripts.

Elegant solution that requires internet access and a domain: Lets Encrypt.

I have a domain that I bought so that I can use it locally. I use lego (https://github.com/go-acme/lego) together with API keys for my providers DNS API. It uses dns authenticated ACME to get a wildcard certificate for *.my.domain. I have a cronjob that runs lego every 4 days, if the certificate gets renewed, lego triggers a shellscript that copies the renewed certificate together with its private key on my routers, internal servers, etc. With a custom DNS server and a dhcp server I make sure that all my local clients get hostname.my.domain fqdns and bam, every browser simply accepts the routers tls certificate out of the box, because they already know the LetsEncrypt CA.

A bit complicated to set up but dead simple to use.