Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

blog.benroux.me

Post reply on HN
Print view View original

31–40 of 76 posts

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#31

Post by laumars »

WildUtah wrote: post #18

Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…

Any device that doesn't support SNI wouldnt be modern enough to support secure cyphers since weaknesses hav e been found in most of the older ones. Plus anything below TLS1.0 shouldn't be supported either (nor even TLS1.0 if you're running something where security really does matter). So you're better off dropping support for the aforementioned devices regardless of whether you choose to use SNI or not.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#32

Post by scrollaway »

WildUtah wrote: post #18

Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…

Also, plugging Caddy: https://caddyserver.com/

I used to be a huge fan of nginx and I haven't touched it in a year now. I don't miss it, Caddy is fantastic and handles the Let's Encrypt stuff for me.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#33

Post by laumars »

pilom wrote: post #23
caleblloyd wrote: post #2

This article advocates for IP Per Domain over SNI. It's 2017, please use SNI. There's not enough IPv4 addresses in the world. Every single major browser supports it, and has supported it for some time: http://caniuse.com/#search=sni

Unfortunately for our ecommerce site this just isn't the at all an option. 3 months ago we analysed our traffic and found that 12% of our desktop traffic didn't support it (Win XP) and about 8% of our mobile traffic didn't support it (Android older than 4.0). I'm not losing 10% of my revenue just so I don't need to get a couple extra IPs from AWS. And even better, AWS doesn't actually charge me for the IPs. Once IPs…

If you're having to support devices that old then I'd be more worried about how you're going to take payment details on your e-commerce website over a "secure" connection that would fail most PCI DSS vulnerability scans.

The security of TLS has come a long long way since XP and so has research into breaking XP-era ciphers.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#34

Post by rnhmjoj »

On a side note: in NixOS ACME has been integrated into the nginx configuration. To set up a server with TLS you just do

  security.acme.certs = {
    "example.com".email = "youremail@address.com";
  };

  services.nginx = {
    enable = true;
    virtualHosts."example.com" = {
      enableSSL  = true;
      enableACME = true;
    };
  };
This fetches the certificates and set up a service and a timer to periodically renew them.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#35

Post by mikeyjk »

WildUtah wrote: post #18

Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…

Even with AWSs load balancers? We are trying to solve this issue right now in house.

Any recommendations/war stories/further reading would be greatly appreciated.

Related forum post:

https://forums.aws.amazon.com/message.jspa?messageID=520926

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#36

Post by schoen »

rnhmjoj wrote: post #34

On a side note: in NixOS ACME has been integrated into the nginx configuration. To set up a server with TLS you just do security.acme.certs = { "example.com".email = "youremail@address.com"; }; services.nginx = { enable = true; virtualHosts."example.com" = { enableSSL = true; enableACME = true; }; }; This fetches the certificates and set up a service and a timer to periodically renew them.

Wow, is their nginx support portable to other OSes? Do you know who has implemented it?

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#37

Post by 65827 »

hawkice wrote: post #11

I've never had a single problem with hosting multiple https domains using Nginx and Let's Encrypt. This article is somewhat baffling, considering his example of clients that need this is "mobile browsers" but I've used iOS and Android and it works just fine.

I was gonna post this same thing. Nginx is super rad.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#38

Post by schoen »

laumars wrote: post #33
pilom wrote: post #23

Earlier quoted context omitted.

Unfortunately for our ecommerce site this just isn't the at all an option. 3 months ago we analysed our traffic and found that 12% of our desktop traffic didn't support it (Win XP) and about 8% of our mobile traffic didn't support it (Android older than 4.0). I'm not losing 10% of my revenue just so I don't need to get a couple extra IPs from AWS. And even better, AWS doesn't actually charge me for the IPs. Once IPs…

If you're having to support devices that old then I'd be more worried about how you're going to take payment details on your e-commerce website over a "secure" connection that would fail most PCI DSS vulnerability scans. The security of TLS has come a long long way since XP and so has research into breaking XP-era ciphers.

Deprecation of old stuff is going incredibly slowly even in rich countries (to the intense frustration of a lot of security teams). Check out the incredible true story, told over years on cabfpub, of the attempt to get rid of SHA-1 in TLS authentication. Notably, the attacks that led to experts' recommendation to move away from SHA-1 immediately were published back in 2005. Meanwhile, Microsoft's "effective date of the SHA-1 deprecation" is tomorrow (!), February 14, 2017.

https://social.technet.microsoft.com/wiki/contents/articles/...

(Let's have a party!)

Figuring out how people are going to get upgraded when problems of some sort are discovered (including software vulnerabilities, not just cryptographic protocol issues) is a major security challenge of our day, maybe the biggest information security problem overall in the world.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#39

Post by CaveTech »

mikeyjk wrote: post #35
WildUtah wrote: post #18

Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…

Even with AWSs load balancers? We are trying to solve this issue right now in house. Any recommendations/war stories/further reading would be greatly appreciated. Related forum post: https://forums.aws.amazon.com/message.jspa?messageID=520926

You need to use SAN certificates to do this (Which LE will do). You just need to be comfortable with having every domain registered appearing on the certificate.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#40

Post by rnhmjoj »

schoen wrote: post #36
rnhmjoj wrote: post #34

On a side note: in NixOS ACME has been integrated into the nginx configuration. To set up a server with TLS you just do security.acme.certs = { "example.com".email = "youremail@address.com"; }; services.nginx = { enable = true; virtualHosts."example.com" = { enableSSL = true; enableACME = true; }; }; This fetches the certificates and set up a service and a timer to periodically renew them.

Wow, is their nginx support portable to other OSes? Do you know who has implemented it?

NixOS modules are built around Nix and systemd so theoretically you could write a port for a different GNU/Linux distribution if you have those available. I'm not aware of any though. There is however a variant for Darwin based on launchd: https://github.com/LnL7/nix-darwin

You can find the implementation of the nginx service here: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/s...

Post reply on HN