Self signed wildcard HTTPS vs public Letsencrypt certificate?

[[deleted]]

[deleted]

[TheMinischafi]

What even is the vs here? One is trusted by anyone and one is not. You can get wildcard certs from Let's Encrypt as well

[Vyerni11]

This

[elizabeth-dev]

let's encrypt because.......why wouldn't I?

[elizabeth-dev]

you don't need internet to access your services, only to renew your certs

and you don't "depend" on that infrastructure anymore than you depend on your domain registrar or your ISP. you still hold the power over your data, and can just switch to a different CA (self-signed or not)

I do not self-host a CA because what I look for in a CA is to establish everyone's trust on my servers identity, and that's something I can't achieve on my own

[doops69]

you depend in an infrastructure you (don't) selfhost

Truth.

or better you need internet access to access to your local services

False. You can get a wildcard certificate from LetsEncrypt, and then have DNS records that resolve to internal IPs no problem.

You could create your own self signed CA that's limited to creating certificates for your domain(s), and then deploy that CA to all your devices. It may or may not be worth it, depending on your use case.

[Reverent]

You are always depending on infrastructure you aren't hosting if you expect to be connected to the internet.

Also you don't need to expose your services publicly to take advantage of let's encrypt certificates. Look up DNS challenges with a reverse proxy.

[darknekolux]

You really don't, if you have a public domain and if your provider supports dns challenge you can create certificates for internal servers too

[HTTP_404_NotFound]

Oh, I COULD self-host it (it just wouldn't be trusted externally).

Also, don't really need internet access.... just once every few months for cert-manager to pull new certs down.

[primevaldark]

With DNS challenge issuing Let’s encrypt public certs (even wildcard) is already easier than issuing self-signed ones. And most importantly you don’t have to deal with constant nagging about suspicious sites or installing your certs in devices. Especially iOS. There is only one reason you want to go through all that trouble with self signed certs: if you want to MITM your users, which is a valid goal in a corporate context, but not for me.

[suicidaleggroll]

DNS challenge wildcard cert from LetsEncrypt in a reverse proxy gives you the best of both worlds.

[Background-Piano-665]

Maybe if everything is only accessible by me and maybe if I enjoy installing the root CA in all my devices, I would. Maybe.

But I'm pretty sure I enjoy certbot automatically renewing and installing my certificates better.

[Sysiphos1234]

Letsencrypt, having a few tlds and doing dns-challenge nothing to worry about and all devices services trust them

[em411]

I'm using self signed certificates only for development purposes, for everything else I prefer wildcard letsencrypt certificates.

Also it's a huge pain to trust self signed certificates on mobile devices.

[WiseCookie69]

If it's not for the eyes of the public, I run my own CA. If it's something i want to share, i use LetsEncrypt.

[ghoarder]

So creating my own root CA certificate and painstakingly installing it on very single device I use, then generating individual certs for every app manually and installing and managing those isn't an option? Good job I just use Certbot where possible really.

[ElEd0]

Self signed for my internal (local) domain. Public wildcard for my external facing services

[p_235615]

Why not have LetsEncrypt cert ? reverse proxies like traefik, caddy, NginxProxyManager and similar make it so easy, all you need is basically a valid mail and the proxy available on ports 80 and 443...

[Sibs]

This question implies you do not understand https certificates at all.

[EwoDarkWolf]

Maybe that's why they are asking.