Viewing profile — benburkert

We don't think of it as reinventing the wheel since it works with all existing RFC compliant ACME clients without needing a plugin. You can use lego, caddy, certbot, cert-manager, …

Sorry, not trying to obfuscate anything, hopefully this clarifies: users trust us to hold their ACME account key and we only ask for DNS records prefixed with `_acme-challenge.` to…

We theoretically could, but those certificates would show up in CT logs. (For quick & easy monitoring, you can get an RSS feed for your domain on https://crt.sh/ , but it's not the…

It does not. Anchor never see sees your private keys for certificates. We hold an ACME account key on your behalf with the CA, but we cannot use it impersonate your domain or decry…

sorry about that! mind sharing what domain name (or something similar that also doesn't work) & what browser you used?

No, they stay on the client, our service only has access to the CSR. From our docs: > The CSR relayed through Anchor does not contain secret information. Anchor never sees the priv…

It's 100% possible today to get certs in segmented networks without a new ACME challenge type: https://anchor.dev/docs/public-certs/acme-relay (disclamer: i'm a founder at anchor.d…

Hi HN! I'm part of the Anchor ( https://anchor.dev/ ) team building lcl.host: https://lcl.host/ > We launched lcl.host in March as the easiest way to get HTTPS in your development …

right it's the loopback, but I believe docker-compose can forward loopback ports to the host (and then back into the other container) using links, but i'm fuzzy on the details and …

we're going to say more about how lcl.host works between containers in the future since it ends up pulling in Anchor's package features, but I can give a quick rundown of what we'v…

We just released a fix for the version error, this will be the last one you see, we promise!

Sorry about that, we're working on switching this to a warning and not an error, that slipped by us before release. After the next update, it will only show a warning if you're not…

We install the CA certificates into the trust stores so that the certificates are trusted by your browsers and clients, otherwise they will (rightfully!) get connection errors. We …

We just see a whole lot of downside and no upside, what reason would someone have other than spoofing a third party domain? I don't think I understand your second question, are you…

Just wanted to clarify that `lcl.host` is a service that only helps with local development, it's not useful (and shouldn't be used) in staging & production environments. For stagin…

It does work, and we've found it to be about as well supported as SAN names, which is pretty extensive these days. It's just not commonly used by public CAs because the real value …

Yes, we do support wildcard certs (and will support IP certs in the future). But we don't let you provision certs for domains that you don't own.

We don't have a paid offering yet. Right now we're focused on local development environments, which is free to use as individuals and organizations. In the future, we'll have a pai…

> My theory for getlocalcert is that the distribution problem is too difficult (for me) to solve, so I layer the tool on top of Let's Encrypt certificates instead. The end result f…

This is a managed SaaS solution, not self-hosted software like the ones listed. We're more akin to one of the certificate management products in cloud providers, but our target use…