Summary

Utilize SSL/TLS for your internal services for your homelab without having to setup an internal certificate authority (CA) by relying on a public CA.

Why not an internal CA?

• Have to setup and maintain an internal CA
• Will need to distribute the root certificate somehow to multiple different devices through some sort of file sharing system (that might need setup itself!)
• Have to figure out (and hopefully automate) installing the root certificate on a bunch of devices of possibly different operating systems

Why this solution then?

• Rely on a public public key infrastructure (PKI) that everyone trusts already
• No need to setup or maintain the public CA ourselves
• Don't have to distribute or install the root certificate since that comes preinstalled on all browsers

Setup Overview

We will be using Cloudflare for our external DNS provider and Traefik as our loadbalancer and SSL termination proxy. Assuming you own a public domain like example.com, we will be putting all our local services behind the subdomain *.local.example.com.

Cloudflare

What is Cloudflare?

Cloudflare is a web infrastructure and web security company that provides CDN services, DDoS mitigation, internet security, and DNS services.

Instructions

We will use them as our external DNS provider.

Make sure you have local.example.com pointed to your home IP address to pass the DNS verification later when attaining a certificate. You can use something like Duck DNS in order to have dynamic DNS if you don't have a fixed public IP.

We can also have a wildcard record for *.local.example.com point to our local Traefik load balancer IP so that devices in your network can get routed to our internal services.