#Certificate Management

TLS certificates for internal services done right

This article presents a best-practice architecture for securing internal services using split-horizon DNS and public TLS certificates rather than self-signed certificates, eliminating the need to distribute and manage certificates across all client machines. By leveraging a VPN with DNS capabilities (NetBird), an ACME client (acme.sh), and a reverse proxy with WAF features (nginx), organizations can achieve secure internal service access with automated certificate renewal while maintaining a clean security posture across layers. For IT organizations, this approach significantly reduces certificate management overhead, improves user experience by eliminating certificate warnings, and strengthens security through defense-in-depth without costly infrastructure changes.