You should be able to do wildcards with acme V2 and a dns challenge: https://community.letsencrypt.org/t/acme-v2-and-wildcard-certificate-support-is-live/55579

You would manage internal dns and would never need to expose anything as it’s all through validation through a TXT record.

You could use also something like traefik to manage the cert generation and reverse proxying:

https://doc.traefik.io/traefik/https/acme/

Certbot in cron if you're still managing servers.

I'm using cert-manager in kube.

I haven't manually managed a certificate in years.. Would never want to do it again either.

I use the linuxserver.io SWAG container. It runs an nginx reverse proxy and does certificate management for you. It's a pretty great minimal-config option.

Probably not the 'recommended' way, but I use a selfsigned cert for each service I'm running generated dynamically on each run with nginx as a reverse proxy. Then I use HAproxy and DNS SRV records to connect to each of those services. HAproxy uses a wildcard cert (*.domain.tld) for the real domain and uses host mapping for each subdomain, (service1.domain.TLD).

This way every service has its traffic encrypted between the HAproxy and the actual service, then the traffic is encrypted with a browser valid cert on the frontend. This way I only need to actually manage 1 cert. The HAproxy one. Its worked great for me for a couple of years now.

Edit: I'm running this setup for about 50 services, but mostly accessed over LAN/VPN.

I use NPM (Nginx Proxy Manager) to handle all my reverse proxying and SSL certs. Authelia easily ties in to handle my SSO. What a time to be alive!

I went with the OpenSSL CA as cryptography has been a weakness of mine and I needed to tackle it. Glad I did, learned a lot throughout the process.

Importing certs is a bit of a pain at first but I just made my public root ca cert valid for 3 years (maybe 5 I can’t remember) and put that public cert in a file share accessible to all my home devices. From each device I go to the file share once, import the public root ca cert and done. It’s a one time per device pain so it’s manageable in my opinion.

Each service gets a 90 day cert signed by root ca and imported to nginx proxy manager to serve up for the service (wikijs.mydomain.io).

Anything externally exposed I use let’s encrypt for cert generation (within NPM) and internally I use the OpenSSL setup.

If you document your process and you’ve done it a few times, it’s gets quicker and easier.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

[Thread #155 for this sub, first seen 22nd Sep 2023, 05:05] [FAQ] [Full list] [Contact] [Source code]

This video was helpful and simple. It’s no longer any hassle. I later implemented the same using my own domain and cloudflare.

https://youtu.be/qlcVx-k-02E

If your running behind OPN/PFsense I've found the easiest solution for internal only SSL is to use the router to create the certificate chains. Yes you'll have to import 1 CA cert on each end user device but only the one then you can crank out internal certs without and https warnings or domain constraints/challenges.

I use Lets encypt and OVH DNS for my certs, I can get a wildcard for mulit service nginx or a single cert for the places that need them. The other thing I want to look at is the Small Step CA, I use that for SSH certs

I just use caddy. Does everything, both local ca and letsencrypt.

I use Caddy with the Cloudflare DNS plugin for Let's Encrypt DNS based challenges, should work for wildcard too but only have a couple subdomains so never tried to do that. My DNS entries are public but point at private IP ranges, e.g. nc.PRIVATEDOMAIN.COM resolves to 192.168.1.20 where Caddy sends the traffic to my Nextcloud docker

I run freeipa internally, which handles all internal https certs (as well as nice things like handling non sudo auth so I can just ssh to machines from an already authed machine without a PW prompt, and doing ldaps for internal things that support it)

For external web, I have a single box running nginx as a reverse proxy thats web exposed. That nginx box has letsencrypt certs for the public web stuff. The nginx rp has the internal CA on it and will validate the internal https certs (no mullet SSL here!)

I also do different domains for internal vs external, but thats not a requirement for a setup like this

Personally: Traefik doing a TLS challenge for a wildcard cert.