For instance how can I use my *.domain.com SSL certs and NPM to route containers to a subdomain without exposing them? The main domain is exposed.
You need a DNS service that works with Let’s encrypt
NPM is in my post…
I don’t get it. Npm is a package manager. It doesn’t handle certificates.
You need a DNS service like route 53 (AWS) or similar where let’s encrypt connects via an API and creates the DNS token.
Then you’re all set, issue certs over DNS-01 challenge in NPM, and create records in your local DNS server that point to the NPM IP for each domain you want to use.
You can use the DNS verification method. Either using nsupdate with bind or what ever protocol your DNS provider and favorite ACME (certbot, acme, lego, etc) utility supports. As long as your DNS server is publically reachable that will work, even if the subdomain itself doesn’t exist publically.
I have that setup, my domain is hosted by OVh and they have an API that you can use to get a wildcard certificate with.
At home I run pihole and that has some sites in as local IPs, but if you look the same site up from OVH you would get an internet IP
OP is asking for cases where you don’t want to allow the service (or reverse proxy) to be accessible via the web.
They do not. See my other reply about DNS verification.
Your response clearly states publicly accessible DNS. A CA does not require anything public for local SSL and can work in conjunction with whatever service they want for that which is public.
Fair, I don’t know why I read OPs post as asking for let’s encrypt certs. Internal CA is indeed an option.
How we’ve done it recently:
- Put domain on cloudflare or another registrar that supports an API. Generate a token with the right privs.
- Use certbot with the cloudflare plugin, and that token, and generate whatever certs you need within that domain using the DNS01 method.
No need to have port 80 open to the world, no need for a reverse proxy, no need for NAT rules to point it to the right machine, no need to even have DNS set up for the hostname. All of that BS is removed.
The token proves your authentication and LetsEncrypt will generate the certs.
