Solved SSL Certificate for LAN

[jjcale]

For several reasons I do not expose my Synology NAS DiskStation to the Internet and only run Photo Station for LAN users:

URL: https://nas.lan/photo
local IP segment: 192.168.0.10/24

When they connect, they all get a warning, that the connection is suspicious and the certificate is not valid (of course).

How can I best fix it? I do have my own domain registered and I do have a public IP on my router (but I don't want to over complicate things).

Tx and wishing you a Happy New Year!

 

[akahan]

If they're connecting from within the LAN, why use https? Just use http, and then you don't need to deal with certificates at all.

 

[jjcale]

If they're connecting from within the LAN, why use https? Just use http, and then you don't need to deal with certificates at all.

The answer is "layered security". If any of the client systems on the LAN get compromised, and installed with bots/malware, they can easily read the HTTP traffic on the LAN. Then connecting to my admin interface on DSM and Photo Station will expose the usernames and passwords in plaintext.

 

[akahan]

Using the DNS configuration at the registrar of your domain name, point the domain name to your WAN address. Install a let's encrypt certificate corresponding to both lan and nas.lan (where lan = your domain name and you have a reverse proxy set to direct traffic to nas.lan to the right device) on the NAS, and have users contact the NAS via the name nas.lan rather than the numeric IP address.

 

[Rusty]

As posted, but be sure that your router supports nat loopback for this to work

 

[one-eyed-king]

You could completly stay within the borders of your local lan, if you add sudomains to your public domain that resolve to local lan ips... In case your router has dns-rebind protection, just add those subdomains in the exclusion list and you are ready to go.

If you are able to use letsencrypts dns challenge to create a wildcard domain certificate, you could use it on those subdomains as well.

 

[jjcale]

You could completly stay within the borders of your local lan, if you add sudomains to your public domain that resolve to local lan ips... In case your router has dns-rebind protection, just add those subdomains in the exclusion list and you are ready to go.

If you are able to use letsencrypts dns challenge to create a wildcard domain certificate, you could use it on those subdomains as well.

Yes, this looks interesting, I need to learn about these technologies in more detail (dns-rebind, dns challange).

Tx

 

[jjcale]

As posted, but be sure that your router supports nat loopback for this to work

I have Turris Omnia, it shouldn't be a problem.

 

[Telos]

Create your own cert...

X - Certificate and Key management

XCA is an x509 certificate generation tool, handling RSA, DSA and EC keys, certificate signing requests (PKCS#10) and CRLs. It supports a broad range of import and export formats.

www.hohnstaedt.de

 

[jjcale]

Using the DNS configuration at the registrar of your domain name, point the domain name to your WAN address. Install a let's encrypt certificate corresponding to both lan and nas.lan (where lan = your domain name and you have a reverse proxy set to direct traffic to nas.lan to the right device) on the NAS, and have users contact the NAS via the name nas.lan rather than the numeric IP address.

I am not sure that I want to open up the HTTP/S ports for my nas.mydomain.eu externally. I have no reverse proxy per se, only NATed internal network and then I would have to set up port forwarding.

 

[jjcale]

You could completly stay within the borders of your local lan, if you add sudomains to your public domain that resolve to local lan ips... In case your router has dns-rebind protection, just add those subdomains in the exclusion list and you are ready to go.

If you are able to use letsencrypts dns challenge to create a wildcard domain certificate, you could use it on those subdomains as well.

Do I understand it correctly as follows?

www.mydomain.eu. IN A x.y.z.w ; This is my web server
nas.local.mydomain.eu. IN A 192.168.1.100 ; This is my nas server

 

[akahan]

You wouldn’t have to open up to the internet except briefly when obtaining your certificate.

 

[jjcale]

Do I understand it correctly as follows?

www.mydomain.eu. IN A x.y.z.w ; This is my web server
nas.local.mydomain.eu. IN A 192.168.1.100 ; This is my nas server

Or do you simply mean to add hosts under
mydomain.eu.
to resolve to local IPs?

I will probably implement a script for automatic renewal using Certbot ACME.

Tx

 

[one-eyed-king]

Just add sub domains and resolve their A-Record to a local ip.

You might want to use dns-01 challange for wildcard certificates rather than http-01 challenge for sub domain specific certificates. One of the advantages of dns-01 is that you don't need to expose any ports to the internet, as it will inject a txt entry into your domain and verifiy it's existance. When using dns-01 you need to put into account that updates on dsn won't be visible immediatly and you will need to use a delay before checking (certbot provides an option for this). In my first attempts I failed to pass the dns-01 challenge verification, becaues I was to impatiant... Certbot provides a list of recommended delays for supported dns api providers. Make sure your script renews the certificates a couple of days before the current expires.

Hint: a wildcard certificate is only valid for the same level, e.g. a certificate for *.domain.tld is not valid for *.sub.domain.tld

 

[durin]

Create your own cert...

X - Certificate and Key management

XCA is an x509 certificate generation tool, handling RSA, DSA and EC keys, certificate signing requests (PKCS#10) and CRLs. It supports a broad range of import and export formats.

www.hohnstaedt.de

How much detail would you need to add on the certificate for it to work?

 

[Telos]

How much detail would you need to add on the certificate for it to work?

If you need is the same as the OP's... a dirt-simple way to avoid the "insecure" browser warning with a self-signed cert can be followed here...

🔒 How to Setup SSL on a Synology NAS | Jean Galea

When you enable SSL on a Synology Diskstation, accessing it over the local network will throw up a selection of security warnings on browsers. There are 3 choices here for the LAN user: Choice 1 is…

jeangalea.com

I've done this and can attest to the fine "padlock" on my LAN IP URL.

 

[jjcale]

If you need is the same as the OP's... a dirt-simple way to avoid the "insecure" browser warning with a self-signed cert can be followed here...

🔒 How to Setup SSL on a Synology NAS | Jean Galea

When you enable SSL on a Synology Diskstation, accessing it over the local network will throw up a selection of security warnings on browsers. There are 3 choices here for the LAN user: Choice 1 is…

jeangalea.com

I've done this and can attest to the fine "padlock" on my LAN IP URL.

This is a simple and yet effective solution for my lan (photo station, dsm administration).
Thanks.