HTTPS on homelab (just locally)

This, letsencrypt with dns challenge, https://desec.io/ to manage the dns records https://github.com/go-acme/lego or traefik to manage the certificates and do the dns challenges for you.

Yes, LetsEncrypt with DNS-01 challenge is the easiest way to go. Be it a single wildcard for all hosts or not.

Running a CA is cool however, just be aware of the risks involved with running your own CA.

You’re adding a root certificate to your systems that will effectively accept any certificate issued with your CA’s key. If your PK gets stolen somehow and you don’t notice it, someone might be issuing certificates that are valid for those machines. Also real CA’s also have ways to revoke certificates that are checked by browsers (OCSP and CRLs), they may employ other techniques such as cross signing and chains of trust. All those make it so a compromised certificate is revoked and not trusted by anyone after the fact.

Tried that once. It was not a fun route to go down. If let's encrypt ever dies it anything fine, I'll look into it again. Until then, let's encrypt all the way

why is creating one's own CA the wrong way? I don't want to have to pay cloudflare or porkbun to run HTTPS at home

I use the OVH plugin to get a wildcard cert for my homelab, that way I can spin up anything and its covered by the cert.

Also, Proxmox and PFSense use the OVH let's encrypt plugin to be secured as well

Yeah. Exactly how I do it. .casa domain to distinguish it from my other domains, DNS challenge and I am good.

Proxmox and OPN Sense work with it themselves, for everything else I use NPM on Proxmox. Couldn't be more happy with that solution.

This assumes ownership of a domain if I'm not mistaken.

Otherwise, yes this is the easiest way.

Yeah I guess installing a root CA cert (or an Intermediate, depending on how complex your setup is) and automatically rotating certs upon expiry isn't the most trivial thing. With that said, dekstop linux/windows isn't a problem. You could theoretically do it on iOS too. Android recently has completely broken this method, however, and there's a fair few hoops one must jump over to insert a root CA into the Android trust store on Android 13 and later. I'd like find a way to do it just for browsers on Android using adb if possible

I agree. Get a domain name, point it to the internal address of your NGINX Proxy manager (or other reverse proxy that manages certificates that you are used to). A bit of work initially, then trivial to add services afterwards.

I didn't really need encryption for my internal services (although I guess that's good), but I kept getting papercuts with browser warnings, not being able to save passwords, and some services (eg container repository on Forgejo) just flat out refusing to trust a http connection.

+1 to NPM. Works really easily for certs and auto renewal.

I also use this and can recommend it

I do this too, have acls setup for my main LAN ips and all my internal hosts setup in opnsense in hosts override so they get redirected to NPM. Not sure if this is the correct way but it gives me all valid certificates. You could also do domain override and redirect just that domain to your NPM.

Or use caddy with a dns challenge. No need to open any ports and just use it completely locally without any annoying warning.

I used the same guide and it works great.

Used this guide too, it was the one that finally made things "click" for me.,

I used it for a while until I outgrew it and managed to setup Traefik.

Just be aware of the risks involved with running your own CA.

You’re adding a root certificate to your systems that will effectively accept any certificate issued with your CA’s key. If your PK gets stolen somehow and you don’t notice it, someone might be issuing certificates that are valid for those machines. Also real CA’s also have ways to revoke certificates that are checked by browsers (OCSP and CRLs), they may employ other techniques such as cross signing and chains of trust. All those make it so a compromised certificate is revoked and not trusted by anyone after the fact.

For what's worth, LetsEncrypt with DNS-01 challenge is way easier to deploy and maintain in your internal hosts than adding a CA and dealing with all the devices that might not like custom CAs. Also more secure.

This is the most permanent solution. You can generate valid and trusted certs for as long as you want. Let's Encrypt is great, but you also have to configure the automation to keep renewing the certs every 30 days.

If you mean signed by your CA then this is me too, albeit with an intermediate CA in the middle (honestly pointless in my case, but old habits etc).

I don't host anything externally and trusting the CA certs internally is easy as Ionly need to do it on a handful of devices. This + reverse proxy keeps things tidy and uncomplicated.

I've been doing it this way for many years, before LetsEncrypt was around. Maybe some day I will switch so I can become dependent on another third party (though I do use LetsEncrypt for public-facing services).

Yes, telling your computer to trust a certificate chain that you are responsible for securing may significantly increase your attack surface. It's easy to forget about that root cert (I actually push mine via GPO).

Just be aware of the risks involved with running your own CA.