Hacker News Reader

I recently found that Tailscale supports procuring real Let's Encrypt certificates for the machines on your private network. So all you have to do on the clients is install Tailscale, which I think is a little easier than trusting self-signed certificates.

View on HN

You can also do this yourself with a domain you own and control. I have done it as well when I wanted SSL on my local LAN. My lan is also assigned a real domain so applying a cert is easy to any of my machines.

interesting found, while the primary purpose of tailscale are easier P2P connection, I might take a look how this real Let's Encrypt certificate are being used for .local/custom FQDN and implement it on Lokal, appreciate it.

To do it they assign the host a subdomain under .ts.net. But your private host isn't exposed to the public internet, I assume they just have a dummy host there to respond to the ACME challenge from Let's Encrypt. When you have the Tailscale VPN installed, I assume it overrides the DNS for ___.ts.net to point to the private IP of your local host.

https://tailscale.com/blog/tls-certs

Go implementation at the end of article.

Reply on news.ycombinator.com