21–30 of 50 posts
I have been using Cloudflare for https for my main site only and have been deciding whether to use Cloudflare for everything or bite the bullet and set up my own https.
I was hoping this was an nginx module where you could specify something like `ssl_letsencrypt on;` and be done with it.
Caddy has this feature and it's amazing. https://caddyserver.com/docs/automatic-https
Here's an nginx one. Took about https://hub.docker.com/r/dmp1ce/nginx-proxy-letsencrypt/
Would love to see a caddy version of same
---
hmm, I guess the current caddy docker images can do this though though they need a little more configuration
Here is my Nginx config for let's encrypt on my case, feel free to criticize or copy it: https://gist.github.com/alex-min/158f35f604b24e163ae9 . I've managed to get a A+ on the ssllab test so it should not be too bad I believe (but I'm not an expert so if you have some idea for improvements, I would be glad).
Domains with this configuration get A+ on ssllabs and securityheaders.io (test with "repo.holocm.org" if you like). It includes an autorenewal script wrapped in a systemd timer unit.
There is one bug, though: The autorenewal script fails because letsencrypt crashes when stdin is not a TTY. ( https://github.com/letsencrypt/letsencrypt/issues/2523 )
Earlier quoted context omitted.
Caddy has this feature and it's amazing. https://caddyserver.com/docs/automatic-https
Know of an automated caddy docker reverse proxy container? Here's an nginx one. Took about https://hub.docker.com/r/dmp1ce/nginx-proxy-letsencrypt/ Would love to see a caddy version of same --- hmm, I guess the current caddy docker images can do this though though they need a little more configuration
One of my tasks this week is to get this in motion.
I tried using the official encrypt client on my low spec VPS this weekend (cent os 6). It wouldn't install as when compiling it runs out of memory. Why so heavyweight. Luckily I found a python script which uses the acme tools stuff and that worked fine. Maybe providing binaries would be another option so I don't have to compile everything myself.
I was hoping this was an nginx module where you could specify something like `ssl_letsencrypt on;` and be done with it.
Or better yet, make "ssl_letsencrypt on;" the default. Make it so that newbies can just apt-get install nginx/apache/lighttpd/etc. and have https up and running, no questions asked. The real reason https adoption isn't up to par has less to do with people not willing to spend money, and more because it's not up by default. Now that https is free, please make it enabled by default.
Has anyone found a good tutorial for DNS-based verification of a Let's Encrypt certificate? It'd simplify life greatly for those of us with multi-server clusters behind an Amazon ELB or something similar.
So I saw the light in the form of a bash-script [0], wrote a short hookscript, and now I can centrally manage through DNS.
There are a couple of example scripts [1], and it really simple to write your own.
[0] https://github.com/lukas2511/letsencrypt.sh
[1] https://github.com/lukas2511/letsencrypt.sh/wiki/Examples-fo...
Earlier quoted context omitted.
Or better yet, make "ssl_letsencrypt on;" the default. Make it so that newbies can just apt-get install nginx/apache/lighttpd/etc. and have https up and running, no questions asked. The real reason https adoption isn't up to par has less to do with people not willing to spend money, and more because it's not up by default. Now that https is free, please make it enabled by default.
That was something that I complained about even before letsencrypt. It's insanely difficult for anyone except crypto experts to figure out a sane selection of cipher suite, so why can't they not just include one or two sane presets with the application, that get updated along with it when algorithms are broken and new ones emerge?
The hardest thing to figure out is HPKP (and I still have not).
Here is my Nginx config for let's encrypt on my case, feel free to criticize or copy it: https://gist.github.com/alex-min/158f35f604b24e163ae9 . I've managed to get a A+ on the ssllab test so it should not be too bad I believe (but I'm not an expert so if you have some idea for improvements, I would be glad).
Here is my Nginx config for let's encrypt on my case, feel free to criticize or copy it: https://gist.github.com/alex-min/158f35f604b24e163ae9 . I've managed to get a A+ on the ssllab test so it should not be too bad I believe (but I'm not an expert so if you have some idea for improvements, I would be glad).
You should also add HPKP (leaf pinning), it insanly powerful and a challange to get right. I have not figured out why the damn ssllabs complains about it to me.