I have a private Apache server, reachable only from my LAN on port 443, with a StartSSL certificate.

Since Firefox 51 was released, I cannot connect to it any longer as the StartSSL root certificate was removed from the trust store.

I considered migrating to Let's Encrypt, but that appears to require a public-facing HTTP server. Is it possible to use Let's Encrypt in my situation?

I would rather avoid paying for an SSL certificate, if at all possible.


If you control DNS for the domain then you can use the dns-01 challenge method to prove ownership by creating a TXT-record.

This can be done manually or automated. I think even the official certbot client now supports dns-01.

A quick Google shows me a bunch of tutorials using various scripts and clients so I won't repeat all of them here. This one specifically automates intranet certificates.

  • Are you sure that it really works on intranet? What if I simply overwrite /etc/resolv.conf of the host on which the certbot runs? – peterh Jan 31 '17 at 2:43
  • @peterh yes, it works on the intranet as per the documentation. – BE77Y Jan 31 '17 at 11:02
  • @peterh I'm not sure what you're attempting by overwriting resolv.conf. The TXT-record needs to be created in public DNS since the Let's Encrypt validation servers, not the certbot client, needs to be able to resolve the record. If it all happened locally the validation wouldn't be worth much. The server for which the cert is issued can be completely private though. – Martijn Heemels Mar 21 at 17:02
  • @MartijnHeemels Well, now I can't understand my this old comment any more. I create intranet certs with letsencrypt by tricking its DNSes on a way, that it shows a third server, with public ip, for all *.intranet.mydomain requests - but it does only for the outgoing DNS servers of the letsencrypt. I got their IPs by tcpdump-ing the incoming DNS traffic. Bind9 has the so-named "views" for that. Thus, this third server can get *.intranet.mydomain certs with a tricky apache configuration tuned for that. After that, the keys can be mirrored into the intranet with rsync scripts. – peterh Mar 21 at 17:10
  • @MartijnHeemels I am doing this because at the time I had troubles to automatize the zone-based authorization of the letsencrypt. Maybe now it would work, but honestly I am not very satisfied with letsencrypt in general (well... with the troubles of its automatization, of course I am very happy that it exists) and I don't want to make it working again, what I've once made okay. (I think we all know the attitude of the bosses about "make it better" tasks like this.) – peterh Mar 21 at 17:12

The certbot client has capability to do a manual DNS challenge. The (currently second most popular) answer found in this question How to use Let's Encrypt DNS challenge validation? has all the details, and I just tested it as working.

Basically, you run this command and follow the directions:

certbot -d site.your.dom.ain --manual --preferred-challenges dns certonly

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.