> ## Content Index
> Fetch the complete content index at: https://sudoreboot.me/llms.txt
> Use this file to discover other available public pages before exploring further.

# No more IP addresses and certificate warnings on the home network
- URL: https://sudoreboot.me/local-https-names/
- Published: 2026-10-20T12:00:00.000Z
- Updated: 2026-10-30T15:47:10.000Z
- Description: A wildcard certificate via DNS-01, a second reverse proxy on its own address, and split DNS that only answers at home.
- Author: Jon
- Tags: Networking, dns, tls

Typing an IP address and a port number, then clicking past a scary certificate warning, is fun exactly once. I wanted every internal service on a proper name with a real, valid certificate, and I didn't want to expose a single one of them to the internet to get it.

## The recipe

1. **A subdomain just for the LAN**, something like `*.lan.example.com`, that only resolves inside the house.
2. **A wildcard certificate from Let's Encrypt** using the *DNS-01* challenge. The reverse proxy proves it owns the domain by creating a TXT record through the DNS provider's API, which means no port has to be open to the internet. This is the trick that makes the whole thing work.
3. **A local DNS server** (your ad-blocking resolver is perfect for this) that answers `*.lan.example.com` with the proxy's address.
4. **A reverse proxy** that maps each name to a service. Mine reads a plain text file of `name upstream flags` and generates its whole config from it. Adding a service is one line.

## Details that save you a weekend

- **Give the LAN proxy its own IP address.** The server already had another proxy on ports 80 and 443 for public traffic. Putting the LAN proxy on a second address means they never fight over ports.
- **Scope the API token** to DNS edits only. If it leaks, editing DNS records is all it can do.
- **Redirect, don't duplicate.** When a service also has a public name, its LAN name just redirects there, so bookmarks and login cookies all live on one hostname.
- **VPN clients** need to use the home DNS server too, or none of the LAN names resolve once you leave the house.

The payoff: every service has a short name you can actually remember, a padlock in the address bar, and not a single new open port.