A publicly trusted certificate can also be used when an i-net CoWork server is reachable only from a private network. The certificate authority needs to validate control of the DNS name, but the web service itself does not need to be reachable from the Internet when you use DNS-01.

Public certificate authorities issue certificates for public DNS names. They do not issue publicly trusted certificates for private IP addresses or names such as server.local and server.internal.

Use a registered domain name for the service, for example app.example.com. Internal DNS can resolve this name to a private address while public DNS is used only for certificate validation. This arrangement is called split DNS.

Important: A certificate proves the identity of a DNS name. It does not make a private server reachable from the Internet and it does not replace network access control.

The following setup keeps the web service private:

1. Create a DNS name below a domain that you control.
2. Configure internal DNS to resolve the name to the private address of the server.
3. Use DNS-01 to prove control of the name.
4. Keep the firewall closed for incoming Internet connections.
5. Configure the certificate and private key for the HTTPS connection.

The Web Server configuration contains the HTTPS port, bind address and external visible URL. The external visible URL is the browser address and does not have to be the address used by public DNS.

Use Tailscale when every user can install a client and access should be limited to known devices. Use an internal certificate authority when you control the trust store on every client device.

A managed tunnel or reverse proxy is suitable when users need browser access without installing a private-network client. These methods add a provider dependency and should be protected with application authentication or an access policy.

• Use a separate DNS API credential with the smallest possible scope.
• Keep the private key on the server or on the system that terminates HTTPS.
• Do not publish the private address in public DNS.
• Check that internal and external DNS answers match the intended access model.
• Test certificate renewal before the certificate expires.
• Do not use a staging certificate for normal users.

The DNS-01 page explains DNS validation and its automated and manual variants. External ACME clients describes how a certificate created outside the server can be installed as a custom certificate. The existing Reverse Proxy Configuration applies when a proxy terminates HTTPS in front of the server.