Non breaking white space. There are a lot of characters in unicode that are used to get text to format correctly for Greek, or Korean, or english. The problem isnt any one language but having unicode work for every language makes it vulnrable. i.e

ψ N̸̹͐͝ő̴̤̗͔͘ř̴̙̅m̵̢̜͉͑̌͜͝á̶̅̓͜l̵͖̔͌͗̑͝ͅ ̸̙̺͉̬̬́t̴̛͈̓e̵͚̳̊̆x̷̤͌̐t̸̯̰̘͉̑̅͒̈́͌ ̵͓̼̤̃g̴͇̥͉̊͑́̚ò̵͕̪͎́̐e̸͓͗̀̀̕s̴̜̾̈́̃͘ ̷̦̪̥̤̅h̷̨̩̝̖̃̏͠e̵͕͎̦̽̀͗̄̏ͅr̷̟̳͈̋́̚e̴̟͘͜͠ ⛥

Although in this case its not unicode but a header in the protocol. The unicode thing was previous text sms bugs.

i mean if you come from North Korea then almost anything else would seem like a progressive utopia to what you grew up with.

Right, i think we are talking about 2 different but very close things. Jet’s post is talking about a setup similar to mine, which is a wildcard certificate which LetsEncrypt only issue with a DNS-01 challenge, which, as you stated, requires the TXT record and not a text file on the server that the HTTP-01 challenge requires. Yes the HTTP-01 challenge would fail for an internal ip because letsencrypt wouldn’t be able to reach your site to check the acme challenge text file.

But for sanity’s sake you can setup a wildcard cert for your homelab. Traefik makes it pretty painless and now you are not having to configure DNS records for your subdomains. For added security your A record on your dns can point to your internal IP address of your reverse proxy which gives everything routed through your proxy TLS but no-one outside your network can access it.

The challenge dosent require your site to be public only the DNS to be public. So your second description works.

Your serve talks to LetsEncrypt. LE gives your server a challenge. Your server adds the challenge record to your public dns. LE confirms the challenge and issues a dns-01 wildcard certificate to your server. LE never had to vist your site to confirm the challenge.

See for yourself and, from a terminal of your choosing, run

nslookup madpsy.nz

You should get back my local ip which doesnt work for anyone outside of my local network.

So what you do is you have an external DNS that sharing your URL. You have the DNS point “myrealcoolurl.net” at 192.168.1.123. Now when anyone goes to “myrealcoolurl.net” the dns points them at 192.168.1.123 which worse case is their own router, if they are on your network though they get pointed at your server and are loving all your home hosted applications.

Now you can get a wildcard TLS cert issued for “myrealcoolyrl.net” and apps in your home network can use https. Anyone outside your network still gets whatever 192.168.1.123 means for them in their home network