Hacker News Reader

I've been using a slightly different approach which skips the mkcert step. I really need to write a blog post, but roughly:

- register a subdomain on getlocalcert.net

- save credentials

- create LetsEncrypt certificate with cert-manager

Since LetsEncrypt is a trusted CA, there is no need for mkcert.

https://github.com/robalexdev/getlocalcert-client-tests/tree...

View on HN

The problem with LetsEncrypt is that now your entire internal infrastructure is visible on CT logs, which gives an attacker an easy index to enumerate and scan infrastructure once they have access to your internal systems somehow.

You can address that quite well with wildcard certificates. Not ideal, but more than enough for a decent homelab and likely a well thought through test environment.

Well, aside from the fact that it's calling out to the internet, the service is in early access. Using cert-manager at and a self-signed cert, you can set this up in a fenced environment as well.

Reply on news.ycombinator.com