Lancert V2

I built Lancert to solve a small problem: getting a publicly trusted TLS certificate for a service running on a private network, without setting up your own domain or installing a local CA on every device.

You can already do this with your own domain and ACME DNS-01. Some web servers can automate most of it too. Lancert is simply meant to remove those extra steps for this particular use case.

The first version of Lancert managed DNS and certificate issuance, and made the resulting certificates available for download.

The first version shared certificates and private keys as part of its local-development model. What I had not taken into account was that, even for development use, this model was not compatible with Let’s Encrypt’s Subscriber Agreement. I stopped certificate issuance and renewal and revoked the remaining valid certificates.

But the original problem was still there.

So I went back to it.

Lancert V2 keeps the DNS part, but moves certificate issuance to the client. The Lancert CLI gets a Lancert hostname for a private IP and obtains the certificate through the standard ACME DNS-01 flow.

The private key is generated and kept locally. Lancert never receives it.

The CLI is just the shortest path through the process. You can also use your own ACME client with Lancert’s DNS service.

Lancert V2 is not tied to Let’s Encrypt. The CLI uses Let’s Encrypt by default, but the DNS service can also be used by ACME clients configured for another ACME-compatible CA.

You could build the same setup with your own domain and DNS provider. Lancert just removes that configuration for this particular use case.