FAQs
Those might have popped-up in your mind.
Categories
Can I Use Let's Encrypt for Internal Websites ?
Yes. Let's Encrypt can be used for certain internal websites, particularly when using the DNS-01 challenge.
For example, an internal HRMS application may use:
https://hrms.company.comand resolve internally to a private IP such as 10.10.20.25.
With DNS-01, Let's Encrypt verifies control of the domain through a DNS record. The HRMS server itself does not need to be publicly accessible.
However, the resulting certificate is still a publicly trusted certificate. It is not a private certificate simply because the server is internal.
This means organizations should consider whether they want their internal applications to use the public Web PKI, including considerations such as Certificate Transparency, DNS dependencies and certificate-renewal infrastructure.
For strictly internal applications, a Private CA is another option. It allows an organization to establish its own controlled trust model for internal servers, hostnames and private IP addresses.
In short: Yes, Let's Encrypt can work for internal websites. The more important question is whether public trust or controlled organizational trust is appropriate for your environment.
Related: What Are the Risks of Using Let's Encrypt for Internal Websites?
Tagged In
No Comments Yet.
What Are the Risks of Using Let's Encrypt for Internal Websites ?
Using Let's Encrypt for an internal website is not inherently insecure. However, using a publicly trusted CA for an internal-only application has some considerations:
1. Certificate Transparency: Publicly trusted certificates are logged in Certificate Transparency systems. Internal hostnames such as vpn.company.com or payroll.company.com may therefore become publicly discoverable.
2. External dependencies: DNS-01 certificate issuance and renewal can depend on your DNS provider, DNS API and Internet connectivity.
3. DNS credentials: Automated DNS-01 requires access to DNS infrastructure. Those credentials need to be carefully protected and restricted.
4. Public trust: An internal HRMS or ERP normally needs to be trusted only by authorized company devices. Public CA trust may therefore provide more trust than the application actually requires.
These are architectural considerations, not vulnerabilities in Let's Encrypt itself.
A Private CA provides an alternative in which the organization controls certificate issuance and which devices trust the CA.
In short: The question is not whether Let's Encrypt is secure, but whether public Web PKI is the right trust model for your internal applications.
Related: Let's Encrypt vs Private CA for Internal Websites
Tagged In
No Comments Yet.
Categories
Tags