Selfhosted

60451 readers

602 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

502

ICANN approves use of .internal domain for your network (www.theregister.com)

submitted 2 years ago by thehatfox@lemmy.world to c/selfhosted@lemmy.world

148 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] Petter1@lemm.ee 1 points 2 years ago (1 children)

Just use only VPN to access your services behind the reverse proxy, if you want prevent unauthorised connections.

CA certificates are not here to prevent someone accessing a site, they are here, so that you can be sure, that the server you are talking to is really the one belonging to the domain you entered and to establish a tunnel in order to send the API calls (html, css, javascript etc.) and answers encrypted.

[–] BestBouclettes@jlai.lu 1 points 2 years ago (1 children)

That's the problem, if anyone somehow gets your root CA key, your encryption is pretty much gone and they can sign whatever they want with your CA.
It's a lot of work to make sure it's safe in a home setup.

[–] prime_number_314159@lemmy.world 6 points 2 years ago (1 children)

You can just issue new certificates one per year, and otherwise keep your personal root CA encrypted. If someone is into your system to the point they can get the key as you use it, there are bigger things to worry about than them impersonating your own services to you.

[–] Petter1@lemm.ee 2 points 2 years ago

And additionally, you can sign intermediate Certificates reducing the risk even more, since you can revoke and re-issue new ones any time.