Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern

codeascraft.com

Post reply on HN
Print view View original

11–20 of 23 posts

Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern

#11

Post by Operyl »

devwastaken wrote: post #10

>To connect all this together, our proxy hosts periodically query CertService for a list of recently modified custom domains. Each host then 1) fetches the new certificates from CertService, 2) writes them to disk, 3) regenerates a config like the one above, and 4) does a graceful restart of Apache. These restarts are staggered across our proxy pool so all but one of the hosts is available and receiving requests from…

I don't believe LE revokes certificates that get renewed, but rather lets them expire. If they implemented their stuff correctly, it should renew roughly 30 days before they expire, which in turns allows for plenty of leeway in adding in new certificates.

Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern

#12

Post by Operyl »

sideproject wrote: post #7

I've googled this subject a number of times over the years and this seems to be the most thorough answer. Thanks for providing it! However, for a small startup (like mine), I think it's still a bit too much work to get this working. I know that there aren't any other "automated" options out there anyway. Perhaps one day. :)

It really isn't, I was able to implement something similar in a matter of about a month by myself at my current employer.

Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern

#13

Post by zhan_eg »

Is't only me, or their initial reasoning ('it's pricey' and a screeenshot of a certificate being $1500+ when you can have it for less than $10) moves the focus of why Let's Encrypt it important - not that it's free, but that the ACME protocol gives you the freedom to generate certificates very easy, and have that setup process even easier for multiple (think all) services flawless.

Congrats for them for supporting Let's Encrypt as an organization (it's not mentioned in the article it is in the comments here).

Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern

#14

Post by bowersbros »

sideproject wrote: post #7

I've googled this subject a number of times over the years and this seems to be the most thorough answer. Thanks for providing it! However, for a small startup (like mine), I think it's still a bit too much work to get this working. I know that there aren't any other "automated" options out there anyway. Perhaps one day. :)

I'll be writing a blog post in the coming week and publishing it on HN regarding how we do it; its a simpler method I think, though we aren't the scale of Etsy yet, but should be useful for smaller startups to adopt.

Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern

#15

Post by richardwhiuk »

cniemira wrote: post #9

It's a good article, but it's a bit light on some of the technical points. We tried doing something similar about a decade ago (before the widespread adoption of SNI) and ran into the classic connected name/host header mismatch problem. Here, it's not explained that client has to have a way to suggest which certificate it's going to validate, and that there wasn't always an answer for that problem. Also curious to kn…

You can basically assume SNI support on all clients. Etsy is using it based on that fragment of Apache config.

Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern

#16

Post by predakanga »

devwastaken wrote: post #10

>To connect all this together, our proxy hosts periodically query CertService for a list of recently modified custom domains. Each host then 1) fetches the new certificates from CertService, 2) writes them to disk, 3) regenerates a config like the one above, and 4) does a graceful restart of Apache. These restarts are staggered across our proxy pool so all but one of the hosts is available and receiving requests from…

I can't speak for Apache configurations, but on-the-fly cert lookup is possible in nginx using the lua_nginx module[1] - IIRC that feature was developed by Cloudflare, to power their SSL termination.

[1]: https://github.com/openresty/lua-nginx-module/#ssl_certifica...

Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern

#17

Post by scurvy »

predakanga wrote: post #16
devwastaken wrote: post #10

>To connect all this together, our proxy hosts periodically query CertService for a list of recently modified custom domains. Each host then 1) fetches the new certificates from CertService, 2) writes them to disk, 3) regenerates a config like the one above, and 4) does a graceful restart of Apache. These restarts are staggered across our proxy pool so all but one of the hosts is available and receiving requests from…

I can't speak for Apache configurations, but on-the-fly cert lookup is possible in nginx using the lua_nginx module[1] - IIRC that feature was developed by Cloudflare, to power their SSL termination. [1]: https://github.com/openresty/lua-nginx-module/#ssl_certifica...

I was also wondering about this. I would have put in the engineering effort to migrate to nginx (at least as a front-end proxy) from Apache for this. Seems like a lot of reloads that could be avoided (even doing graceful reloads in Apache gives me the willies).

Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern

#18

Post by mnordhoff »

zhan_eg wrote: post #13

Is't only me, or their initial reasoning ('it's pricey' and a screeenshot of a certificate being $1500+ when you can have it for less than $10) moves the focus of why Let's Encrypt it important - not that it's free, but that the ACME protocol gives you the freedom to generate certificates very easy, and have that setup process even easier for multiple (think all) services flawless. Congrats for them for supporting Le…

You're right, but i'm afraid to imagine how much it costs to get an enterprise account with one of the major CAs with API access to issue hundreds of thousands of certificates.

Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern

#19

Post by seanp2k2 »

scurvy wrote: post #17
predakanga wrote: post #16

Earlier quoted context omitted.

I can't speak for Apache configurations, but on-the-fly cert lookup is possible in nginx using the lua_nginx module[1] - IIRC that feature was developed by Cloudflare, to power their SSL termination. [1]: https://github.com/openresty/lua-nginx-module/#ssl_certifica...

I was also wondering about this. I would have put in the engineering effort to migrate to nginx (at least as a front-end proxy) from Apache for this. Seems like a lot of reloads that could be avoided (even doing graceful reloads in Apache gives me the willies).

http://kb.linuxvirtualserver.org/wiki/IPVS

This stuff is ancient but still works great.

Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern

#20

Post by no1youknowz »

bowersbros wrote: post #14
sideproject wrote: post #7

I've googled this subject a number of times over the years and this seems to be the most thorough answer. Thanks for providing it! However, for a small startup (like mine), I think it's still a bit too much work to get this working. I know that there aren't any other "automated" options out there anyway. Perhaps one day. :)

I'll be writing a blog post in the coming week and publishing it on HN regarding how we do it; its a simpler method I think, though we aren't the scale of Etsy yet, but should be useful for smaller startups to adopt.

Thank you for this. Like the GP, I am a start-up and with my current workload, it too is a bit too much.

Looking forward to seeing your work. Will definitely aim to provide feedback too!

(upvoted)

Post reply on HN