Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx • Hacker News Board

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#41

Post by pilif » Mon, Feb 22, 2016, 8:24 PM UTC

jimjag wrote: post #39

pilif wrote: post #12

Earlier quoted context omitted.

this is how it should work. Very nice. I can't wait for other web servers to gain this ability too. Or at least allow us to load certificates from dynamic locations based on some request data. All other web servers I looked at (nginx, apache, lighttpd) still require at least a reload for an updated certificate and a configuration file change for a new certificate to be used. I wonder how caddy works with the very low…

From what I can see, Caddy also does a reload. With Apache, you can do a Graceful restart and not lose any traffic, plus, using mod_lua you could create a relatively easy way to add this automagically.

nginx you can also reload gracefully using the same mechanism. Still. It would be cool if it wasn't needed. I mean - you don't normally restart web servers when a file in the document root changes - why would you still have to do this for changes to SSL certs.

(note: I know that these are two very different things and I know how complicated it is to get all that state correct and to properly re-initialize the SSL context - still, as certificates get more and more short-lived, this would be a cool thing to have)

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#42

Post by pilif » Mon, Feb 22, 2016, 8:27 PM UTC

hlandau wrote: post #34

pilif wrote: post #10

The official let's encrypt client is very heavy-weight. In my case I've build a much simpler thing using acmetool ( https://github.com/hlandau/acme ) which is mcuh simpler to use and nicely runs without root rights. In my case, a lot of the routing of domains to customers is stored in a postgres database and a trigger fires an event anyways, so I have a little daemon that listens to these events and the fires off acm…

I'm the author of acmetool. It's quite interesting to know that people are using the design to its full potential. Ideally, I should probably make something more library/daemon-based for these largescale, custom solutions, though of course I'd like to do it some manner of modular way that allows the existing codebase to be leveraged. For the time being only the acmeapi package within acmetool is stable and suitable f…

For me, the current interface is perfect (though I wouldn't call our usage large-scale by a long shot), though it would be even better if acmetool would indicate using the exit code whether the web server needs restarting or not after reconciliation.

I know there are the hooks and that's what I'm using now, but if I could get a distinct exit code to tell me that changes happened to the certificate store, then I could get away without needing to also keeping the hooks around.

That said, this should probably be on your github issues, not in here. That also said: This was such a small issue for me that I didn't even want to bother you - but as you're coming here to post, I guess it doesn't hurt :p

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#43

Post by hlandau » Mon, Feb 22, 2016, 8:43 PM UTC

pilif wrote: post #42

hlandau wrote: post #34

Earlier quoted context omitted.

I'm the author of acmetool. It's quite interesting to know that people are using the design to its full potential. Ideally, I should probably make something more library/daemon-based for these largescale, custom solutions, though of course I'd like to do it some manner of modular way that allows the existing codebase to be leveraged. For the time being only the acmeapi package within acmetool is stable and suitable f…

For me, the current interface is perfect (though I wouldn't call our usage large-scale by a long shot), though it would be even better if acmetool would indicate using the exit code whether the web server needs restarting or not after reconciliation. I know there are the hooks and that's what I'm using now, but if I could get a distinct exit code to tell me that changes happened to the certificate store, then I could…

I can't use the exit code, because a nonzero exit code by UNIX convention indicates failure, which will spam people in their cron jobs. There's only one exit code which conventionally means 'success'.

I could modify acmetool to output a word 'NEEDS-RELOADING' or something, which you could grep for programmatically. But this is another option (it would have to be an option; any output from acmetool is liable to get e. mailed to people via cron) for something which can be, as you yourself admit, dealt with as well via hooks. And probably more robustly, too. So on balance, I don't think it's worth doing.

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#44

Post by mholt » Mon, Feb 22, 2016, 8:55 PM UTC

jimjag wrote: post #39

pilif wrote: post #12

Earlier quoted context omitted.

this is how it should work. Very nice. I can't wait for other web servers to gain this ability too. Or at least allow us to load certificates from dynamic locations based on some request data. All other web servers I looked at (nginx, apache, lighttpd) still require at least a reload for an updated certificate and a configuration file change for a new certificate to be used. I wonder how caddy works with the very low…

From what I can see, Caddy also does a reload. With Apache, you can do a Graceful restart and not lose any traffic, plus, using mod_lua you could create a relatively easy way to add this automagically.

Caddy does graceful reload with zero downtime on Linux.

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#45

Post by hlandau » Mon, Feb 22, 2016, 9:06 PM UTC

mholt wrote: post #37

hlandau wrote: post #34

Earlier quoted context omitted.

I'm the author of acmetool. It's quite interesting to know that people are using the design to its full potential. Ideally, I should probably make something more library/daemon-based for these largescale, custom solutions, though of course I'd like to do it some manner of modular way that allows the existing codebase to be leveraged. For the time being only the acmeapi package within acmetool is stable and suitable f…

We should join forces with https://github.com/mholt/certs then. (Still in design phase.)

I've done some thinking on what makes sense and ended up at this very rough first sketch. Comments welcome.

https://gist.github.com/hlandau/ed6a96150c69945143be

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#46

Post by mholt » Mon, Feb 22, 2016, 10:23 PM UTC

pilif wrote: post #41

jimjag wrote: post #39

Earlier quoted context omitted.

From what I can see, Caddy also does a reload. With Apache, you can do a Graceful restart and not lose any traffic, plus, using mod_lua you could create a relatively easy way to add this automagically.

nginx you can also reload gracefully using the same mechanism. Still. It would be cool if it wasn't needed. I mean - you don't normally restart web servers when a file in the document root changes - why would you still have to do this for changes to SSL certs. (note: I know that these are two very different things and I know how complicated it is to get all that state correct and to properly re-initialize the SSL con…

FWIW, Caddy's next version will be able to update the certs without reloading at all.

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#47

Post by serge2k » Mon, Feb 22, 2016, 10:51 PM UTC

nickik wrote: post #28

majewsky wrote: post #26

Earlier quoted context omitted.

That was something that I complained about even before letsencrypt. It's insanely difficult for anyone except crypto experts to figure out a sane selection of cipher suite, so why can't they not just include one or two sane presets with the application, that get updated along with it when algorithms are broken and new ones emerge?

I just went threw a full configuration and the cipther suit was the easiest. I had some guides and the basically said, copy this or this depending on how prohibitive you want it. The hardest thing to figure out is HPKP (and I still have not).

are the guides up to date?

I used https://cipherli.st/

hopefully it's good, if not it isn't protecting anything important really

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#48

Post by andmarios » Mon, Feb 22, 2016, 11:32 PM UTC

I've made an ansible role for deploying many sites from one nginx instance with automatic issuing and renewal of let's encrypt certificates.

It would be accompanied by a blog post to explain how things work but got busy on other fronts.

If anyone's interested, it's at https://github.com/Landoop/ansible

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#49

Post by herbst » Tue, Feb 23, 2016, 9:42 AM UTC

dizzystar wrote: post #5

How ironic. I just added https to my site and was searching for a solution to this problem. I ended up using certonly --standalone as described here and it worked like a charm: https://www.digitalocean.com/community/tutorials/how-to-secu...

I ended up still buying my certs because no solution seemed like something i should and could easily automate :/

Re: Using Free SSL/TLS Certificates from Let’s Encrypt for Nginx

#50

Post by benileo » Tue, Feb 23, 2016, 6:46 PM UTC

I had to add some extra nginx config to make this work ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';