2

For internal-only servers which may have outbound access to the Internet, but for which their web services are running internal only and are not accessible from outside the organisation, is it possible to install SSL certificates as issued by a recognised certificate authority?

In this scenario the domain names will not be resolvable outside of the organisation, but are valid FQDNs, for example they may be sub-domains of a real .com domain but for which there are no public DNS records and no intention of there being a possibility for it to be accessed by the public. The domains work internally due to entries on the internal DNS servers, and the firewall deliberately has these servers segregated on internal network.

Use of a domain name to access the web services is purely to help users remember the address rather than an IP address and port number, and using SSL would be beneficial to prevent internal sniffing/interception of traffic (including login details) to and from these web services.

Rather than commit straight away to buying a SAN SSL certificate for these domains, I thought I'd try a certificate from Let's Encrypt first and see if it will work ok. It's the domain ownership verification step I get stuck at - since Let's Encrypt cannot access these services with them not being publicly available, and with the public DNS not even existing for the hostname/A records.

If I were to create a public DNS record and point it at a different server which is publicly accessible and host that file for ownership verification, would that be sufficient to satisfy the requirement and allow me to download and install the certificate manually, or am I likely to run into further problems if I then subsequently delete the public DNS record and verification file? I wouldn't use Let's Encrypt certificates in this circumstance otherwise I'd have to do this every 90 days.

I am interested in using SSL certificates from a certificate authority rather than self-signed so as to avoid the browser warnings, hassle of setting up and maintaining an internal certificate server and having to install a new certificate authority on all client devices.

Does anyone else here use certificate authority issued certificates (such as from Thawte, GoDaddy, GeoTrust, InstantSSL etc) for internal/private/offline servers, and if so how have you managed the Domain Validation process? It appears as though this is required for all types of SSL - DV, OV, EV - but please correct me if I'm wrong or there are exceptions. Is there a better way to use SSL internally other than what I have discussed here? Thank you.

  • What Operating systems are you using internally? are you using Microsoft Operating systems joined to a domain? – Michael Brown Mar 3 '17 at 10:54
  • @Michael_Brown Yes for MS servers (including AD, DNS) but otherwise no, the servers I'm looking to install SSL onto are running CentOS, and the end user clients are not joined to a domain, and vary between PC, Mac, Linux, plus a plethora of more unusual brands and device types. – richhallstoke Mar 3 '17 at 12:11
  • Any ideas/solutions anyone? Thank you. – richhallstoke Mar 9 '17 at 12:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.