Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

nginx.com

Post reply on HN
Print view View original

31–40 of 50 posts

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#31

Post by tombrossman »

nickik wrote: post #29
realusername wrote: post #19

Here is my Nginx config for let's encrypt on my case, feel free to criticize or copy it: https://gist.github.com/alex-min/158f35f604b24e163ae9 . I've managed to get a A+ on the ssllab test so it should not be too bad I believe (but I'm not an expert so if you have some idea for improvements, I would be glad).

You should also add HPKP (leaf pinning), it insanly powerful and a challange to get right. I have not figured out why the damn ssllabs complains about it to me.

I have the same problem, if I use one of the HPKP generators (or copy-paste a 'correct' example & substitute my cert hashes) I always get the SSL Labs error. Everything else is perfect. Depending on what guide I follow, I get Nginx errors, SSL Labs errors, or other third-party test errors. Never a consensus, which is what I would expect once everything is 100% correct.

I'll have to set aside a few more hours to figure this out soon. Even good documentation like this is not working for me: https://developer.mozilla.org/en-US/docs/Web/Security/Public...

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#32

Post by planetjones »

majewsky wrote: post #25
planetjones wrote: post #20

I tried using the official encrypt client on my low spec VPS this weekend (cent os 6). It wouldn't install as when compiling it runs out of memory. Why so heavyweight. Luckily I found a python script which uses the acme tools stuff and that worked fine. Maybe providing binaries would be another option so I don't have to compile everything myself.

What were you compiling? The official client is written in Python.

The letscrypt auto thing.

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#33

Post by rorosaurus »

planetjones wrote: post #32
majewsky wrote: post #25

Earlier quoted context omitted.

What were you compiling? The official client is written in Python.

The letscrypt auto thing.

Yeah, their documentation isn't very clear that auto actually compiles a bunch of stuff on the fly for you. I ran into the same issue as you with my low-spec VPS as well. You can either add some swap space, or run just "letsencrypt -certonly" and skip the auto junk, but it sounds like you did that with the acme client already. :) I've got an open issue on their github page to try and clarify the memory requirements for low-spec VPS..

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#34

Post by hlandau »

pilif wrote: post #10

The official let's encrypt client is very heavy-weight. In my case I've build a much simpler thing using acmetool ( https://github.com/hlandau/acme ) which is mcuh simpler to use and nicely runs without root rights. In my case, a lot of the routing of domains to customers is stored in a postgres database and a trigger fires an event anyways, so I have a little daemon that listens to these events and the fires off acm…

I'm the author of acmetool.

It's quite interesting to know that people are using the design to its full potential. Ideally, I should probably make something more library/daemon-based for these largescale, custom solutions, though of course I'd like to do it some manner of modular way that allows the existing codebase to be leveraged. For the time being only the acmeapi package within acmetool is stable and suitable for use by other libraries. Something to think about...

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#35

Post by veeti »

ceejayoz wrote: post #18

Has anyone found a good tutorial for DNS-based verification of a Let's Encrypt certificate? It'd simplify life greatly for those of us with multi-server clusters behind an Amazon ELB or something similar.

If you don't mind renewing manually every 3 months, my manual client [1] does DNS.

https://github.com/veeti/manuale

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#36

Post by veeti »

majewsky wrote: post #25
planetjones wrote: post #20

I tried using the official encrypt client on my low spec VPS this weekend (cent os 6). It wouldn't install as when compiling it runs out of memory. Why so heavyweight. Luckily I found a python script which uses the acme tools stuff and that worked fine. Maybe providing binaries would be another option so I don't have to compile everything myself.

What were you compiling? The official client is written in Python.

Third party libraries used by the client require C extensions.

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#37

Post by mholt »

hlandau wrote: post #34
pilif wrote: post #10

The official let's encrypt client is very heavy-weight. In my case I've build a much simpler thing using acmetool ( https://github.com/hlandau/acme ) which is mcuh simpler to use and nicely runs without root rights. In my case, a lot of the routing of domains to customers is stored in a postgres database and a trigger fires an event anyways, so I have a little daemon that listens to these events and the fires off acm…

I'm the author of acmetool. It's quite interesting to know that people are using the design to its full potential. Ideally, I should probably make something more library/daemon-based for these largescale, custom solutions, though of course I'd like to do it some manner of modular way that allows the existing codebase to be leveraged. For the time being only the acmeapi package within acmetool is stable and suitable f…

We should join forces with https://github.com/mholt/certs then. (Still in design phase.)

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#38

Post by newman314 »

mark_l_watson wrote: post #21

Thanks for the article and the other discusions, especially the pointers to Caddy. I have been using Cloudflare for https for my main site only and have been deciding whether to use Cloudflare for everything or bite the bullet and set up my own https.

You should do both.

HTTPS from user to CF HTTPS from CF to your site

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#39

Post by jimjag »

pilif wrote: post #12
joshmanders wrote: post #6

Earlier quoted context omitted.

Caddy has this feature and it's amazing. https://caddyserver.com/docs/automatic-https

this is how it should work. Very nice. I can't wait for other web servers to gain this ability too. Or at least allow us to load certificates from dynamic locations based on some request data. All other web servers I looked at (nginx, apache, lighttpd) still require at least a reload for an updated certificate and a configuration file change for a new certificate to be used. I wonder how caddy works with the very low…

From what I can see, Caddy also does a reload. With Apache, you can do a Graceful restart and not lose any traffic, plus, using mod_lua you could create a relatively easy way to add this automagically.

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#40

Post by grey-area »

Cyph0n wrote: post #7
joshmanders wrote: post #6

Earlier quoted context omitted.

Caddy has this feature and it's amazing. https://caddyserver.com/docs/automatic-https

Wow. I might check try it out then.

I would definitely recommend it, I've replaced a few instances of nginx with it with no problems. It is based on the really solid net/http code from golang std lib and adds a few nice things like automatic tls/certs.
Post reply on HN