We run AWS EKS across four VPC environments—corporate, development, staging, and production—and use Envoy Gateway behind internal Network Load Balancers. cert-manager currently obtains certificates through DNS-01 validation against our public foo.com hosted zone, using names such as dev.foo.com, stage.foo.com, prod.foo.com, and corp.foo.com for internal tools like Grafana, GitLab, and Argo CD. Everything is working, but we are wondering whether DNS-01 was the best choice over HTTP-01. We are also considering creating a separate hosted zone such as foo.internal to make the internal-only naming clearer. Is our current approach sound, and would a separate internal zone be worthwhile?
3 Answers
DNS-01 is the better fit here. HTTP-01 generally requires the ACME validation endpoint to be reachable from the public internet, which is awkward or impossible for services behind internal load balancers. DNS-01 works without exposing those services and can also support wildcard certificates. Using the public domain you already control is usually fine even when the records resolve only to private addresses, and it avoids split-horizon naming conflicts. A second zone may improve organization, but it is not required just because the services are internal.
Your current arrangement sounds perfectly workable. Keep the public domain if it is already established and controlled by your organization; using a name such as foo.internal mainly adds another zone and more DNS administration. If you do create a separate internal namespace, make sure every client and resolver can consistently resolve it, and remember that certificates from a public ACME CA cannot be issued for arbitrary private-only names. The important part is protecting the DNS-01 credentials with narrowly scoped permissions and limiting which zones cert-manager can modify.
Another valid option is to run a private certificate authority and configure cert-manager to issue certificates from it. That gives you control over lifetimes and keeps internal certificates out of a public ACME service. The tradeoff is client trust: every workstation, browser, container, and other consumer must trust your private root, and you also take on CA backup, rotation, security, and lifecycle management. For a small team, a managed private CA may be simpler if the operational cost is acceptable.
A private CA works best when you have reliable endpoint management. Otherwise distributing and maintaining the root certificate across laptops and other clients can become more painful than using publicly trusted certificates.
That makes sense. We mainly wanted confirmation that DNS-01 was not overcomplicating things, so it is good to know the current setup is reasonable.