@viragomann said in Using LetsEncrypt Certificate for Web Configurator Authentication:
I don't believe, that Lets Encrypt has signed a certificate for 192.168.1.1.
They expressly state in their User manual that they only use domain names, and NOT IP addresses.
@pslinn said in Using LetsEncrypt Certificate for Web Configurator Authentication:
Once changes are saved I log out of the pfsense system and type in the url:
https://192.168.1.1:443
You all work, and you missed the most important reason why you were asking for a certificate :
So you don't have to use htpp://192.168.1.1 anymore, but now you can use :
241d7ea4-e72e-4cba-8518-19f1669d2a34-image.png
https://pfSense.some-domain-name-that-you-rent.tld
and yes, "some-domain-name-that-you-rent.tld" is a domain name that you have to rent.
Letsencrypt does just one thing : they will test taht you 'own' (= control) that domain name.
@pslinn said in Using LetsEncrypt Certificate for Web Configurator Authentication:
went to dns resolver
under General Settings went to Host Overrides
selected Add and typed in the requested contents including alias'.
You don't have to do this.
If you asked letsencrypt to create this cert for you :
pfSense.some-domain-name-that-you-rent.tld
and because pfSense already has "pfSense.some-domain-name-that-you-rent.tld" loaded into the DNS (point to 192.168.1.1)
...
edit : do not believe me !!
Go check yourself, using your equipment :
nslookup pfSense.some-domain-name-that-you-rent.tld
the answer will be :
192.168.1.1
....
So your browser (PC) can resolve "pfSense.some-domain-name-that-you-rent.tld" as pfSense has the answer (and yes, 8.8.8.8 has not !! (of course))
So the browser can nw connect to the resolved domain name = "192.168.1.1"
So the pfSense GUI, connected over https (using port 443) will hand over a certificate to the browser stating that this certificate belongs to "pfSense.some-domain-name-that-you-rent.tld"
And that is just great : the browser was initially using "pfSense.some-domain-name-that-you-rent.tld", got 192.1368.1.1 as the address where the server can be found, got a cert back from this web server that it is "pfSense.some-domain-name-that-you-rent.tld" => this is what https is all about. Nothing more, nothing less.
Oh, yes, now everybody knows who is who, some random numbers can be exchanged securely so the entire traffic can also be encrypted decrypted on both side so the traffic passes over the 'possible hostile network on a secured way, and can not be altered while going over the wire.
Btw : if you ask for a wild card certicate like
"some-domain-name-that-you-rent.tld"
"*.some-domain-name-that-you-rent.tld"
( this means : the top level domain name "some-domain-name-that-you-rent.tld"
and
all the sub domains "*.some-domain-name-that-you-rent.tld" )
you can now use your certificate for
pfsense.some-domain-name-that-you-rent.tld
printer.some-domain-name-that-you-rent.tld
nas.some-domain-name-that-you-rent.tld
when you've installed the certificate on your printer, nas etc.
Now you can use "https" to access all these devices (if they support it).
