KubeRoot

Jet says the following

If you want https it’s gotta be a external DNS record anyway, might as well point to internal ips

My point is, the A record, the one pointing to an IP address, doesn’t need to be public/external, it’s not needed for the wildcard cert, so it can be kept internal.

I’m mentioning the other challenge trying to make it clear why the record matters for that, and not for a wildcard cert, sorry if that just made things more confusing.

The point is, the challenge doesn’t require a public DNS A record pointing to your IP, it’s not involved in issuing a wildcard certificate. It requires you to control DNS records for the domain to issue a temporary TXT or something record to prove it, one which you can remove afterwards. This was my point in the original comment.

It’s A and AAAA records that are used when you open a website in a browser to map the domain to an IP address, the ones I’m saying don’t need to be public.

The challenge dosent require your site to be public only the DNS to be public.

And just to be clear, that was describing a different kind of challenge, the simpler one which most people probably use, and which does actually involve A records.

I’m a bit confused by what you’re saying, because to my knowledge the DNS entry you’re mentioning won’t help with getting a certificate at all. Challenges will typically require either having the DNS entry point to a publicly reachable website (doesn’t get you wildcard) or proving the ability to modify records for the domain by adding something like a TXT record on the fly, which shouldn’t require A/AAAA records.

So you should be able to do the second type of challenge without a global A record to get a wildcard certificate, and use local DNS for the A record?

If you want https it’s gotta be a external DNS record anyway

Not sure what you mean by that, but off the top of my head, you can get certificates via challenges that prove DNS control (rather than checking if the DNS points to your server), and you can get wildcard certificates so you don’t even have to expose the existence of subdomains.

And that’s ignoring the option of using your own CA, which only really works with your own devices, but for local access might be viable.