Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSL now available for Tumblr blogs with custom domains

security.tumblr.com

Post reply on HN
Print view View original

11–20 of 20 posts

Re: SSL now available for Tumblr blogs with custom domains

#11

Post by c_prompt »

sideproject wrote: post #6

How would one achieve this using LetsEncrypt? I have a platform where my customers can use their own domain. But I am not sure of an easy (automated) way of doing this using LetsEncrypt. There was a post awhile back that explained how Etsy does it ( https://codeascraft.com/2017/01/31/how-etsy-manages-https-an... ) But it was wwaayy too much for a small startup like me. I can think of a manual way of course.

valME.io, the blogging site I developed, has been doing this for years [1]. A user can provide their own SSL cert if they want but typically I just set them up via Let's Encrypt and then it does its automatic renewal process. If you're on a VPS, it's straight-forward to setup one of many ACME client alternatives [2]. If you're on shared hosting, it will depend on the hosting provider (some might even have it integrated if they use an administrative tool like Virtualmin).

[1] https://valme.io/c/gettingstarted/69qqs/valme-io-now-with-cu... [2] https://letsencrypt.org/docs/client-options/

Re: SSL now available for Tumblr blogs with custom domains

#12

Post by corobo »

sideproject wrote: post #6

How would one achieve this using LetsEncrypt? I have a platform where my customers can use their own domain. But I am not sure of an easy (automated) way of doing this using LetsEncrypt. There was a post awhile back that explained how Etsy does it ( https://codeascraft.com/2017/01/31/how-etsy-manages-https-an... ) But it was wwaayy too much for a small startup like me. I can think of a manual way of course.

I recently came across fly.io (possibly on HN) which looks like it may help here, at least in the interim while you're a small startup. To note they do it for you similar to how Cloudflare would do it - you route your site through them - so it may not be what you're looking for.

https://fly.io/mix/custom-hostnames/

No affiliation on my part, the service has just ticked enough "ooh" boxes I'm intrigued and am looking at using them for a project or two

Re: SSL now available for Tumblr blogs with custom domains

#13

Post by stevoski »

corobo wrote: post #12
sideproject wrote: post #6

How would one achieve this using LetsEncrypt? I have a platform where my customers can use their own domain. But I am not sure of an easy (automated) way of doing this using LetsEncrypt. There was a post awhile back that explained how Etsy does it ( https://codeascraft.com/2017/01/31/how-etsy-manages-https-an... ) But it was wwaayy too much for a small startup like me. I can think of a manual way of course.

I recently came across fly.io (possibly on HN) which looks like it may help here, at least in the interim while you're a small startup. To note they do it for you similar to how Cloudflare would do it - you route your site through them - so it may not be what you're looking for. https://fly.io/mix/custom-hostnames/ No affiliation on my part, the service has just ticked enough "ooh" boxes I'm intrigued and am looking…

I briefly checked out fly.io as a solution for this. It worked brilliantly.

I chose not to use fly.io though, because I was ultimately putting control of the DNS settings for all of my SaaS's custom domains in their hands.

Re: SSL now available for Tumblr blogs with custom domains

#14

Post by corobo »

stevoski wrote: post #13
corobo wrote: post #12

Earlier quoted context omitted.

I recently came across fly.io (possibly on HN) which looks like it may help here, at least in the interim while you're a small startup. To note they do it for you similar to how Cloudflare would do it - you route your site through them - so it may not be what you're looking for. https://fly.io/mix/custom-hostnames/ No affiliation on my part, the service has just ticked enough "ooh" boxes I'm intrigued and am looking…

I briefly checked out fly.io as a solution for this. It worked brilliantly. I chose not to use fly.io though, because I was ultimately putting control of the DNS settings for all of my SaaS's custom domains in their hands.

The way I was going to do it personally was have customers point to a domain I control which then CNAMEs to the DNS record fly.io provides me. Not that I don't trust them or anything, but because I don't trust anyone completely :P In serious it was more to avoid any brand confusion.

At least that way I could in the worst case scenario cobble something together that replaces it in the event of a sunset or the likes

Re: SSL now available for Tumblr blogs with custom domains

#16

Post by ngrilly »

j_s wrote: post #7
sideproject wrote: post #6

How would one achieve this using LetsEncrypt? I have a platform where my customers can use their own domain. But I am not sure of an easy (automated) way of doing this using LetsEncrypt. There was a post awhile back that explained how Etsy does it ( https://codeascraft.com/2017/01/31/how-etsy-manages-https-an... ) But it was wwaayy too much for a small startup like me. I can think of a manual way of course.

I think caddy supports automagically combining multiple domains on LetsEncrypt certificate requests. It is possible to set it up as a proxy just to get certificates but be aware of rate limit issues, especially if a domain expires or otherwise becomes invalid. https://caddyserver.com/ I was trying to use it temporarily as the simplest way to get a multi-domain LetsEncrypt cert on Windows, but ran out of time attempti…

By design, Caddy doesn't support SAN certificates:

https://github.com/mholt/caddy/issues/831

Re: SSL now available for Tumblr blogs with custom domains

#17

Post by ngrilly »

sideproject wrote: post #6

How would one achieve this using LetsEncrypt? I have a platform where my customers can use their own domain. But I am not sure of an easy (automated) way of doing this using LetsEncrypt. There was a post awhile back that explained how Etsy does it ( https://codeascraft.com/2017/01/31/how-etsy-manages-https-an... ) But it was wwaayy too much for a small startup like me. I can think of a manual way of course.

Great post from Etsy!

Re: SSL now available for Tumblr blogs with custom domains

#18

Post by j_s »

ngrilly wrote: post #16
j_s wrote: post #7

Earlier quoted context omitted.

I think caddy supports automagically combining multiple domains on LetsEncrypt certificate requests. It is possible to set it up as a proxy just to get certificates but be aware of rate limit issues, especially if a domain expires or otherwise becomes invalid. https://caddyserver.com/ I was trying to use it temporarily as the simplest way to get a multi-domain LetsEncrypt cert on Windows, but ran out of time attempti…

By design, Caddy doesn't support SAN certificates: https://github.com/mholt/caddy/issues/831

Thanks for clearing up my confusion. From the discussion there it looks like this project might meet OP's needs:

https://github.com/containous/traefik

Re: SSL now available for Tumblr blogs with custom domains

#19

Post by ngrilly »

j_s wrote: post #18
ngrilly wrote: post #16

Earlier quoted context omitted.

By design, Caddy doesn't support SAN certificates: https://github.com/mholt/caddy/issues/831

Thanks for clearing up my confusion. From the discussion there it looks like this project might meet OP's needs: https://github.com/containous/traefik

Yes, it looks like Traefik handles SAN certificates from LE.

Re: SSL now available for Tumblr blogs with custom domains

#20

Post by stedaniels »

sideproject wrote: post #6

How would one achieve this using LetsEncrypt? I have a platform where my customers can use their own domain. But I am not sure of an easy (automated) way of doing this using LetsEncrypt. There was a post awhile back that explained how Etsy does it ( https://codeascraft.com/2017/01/31/how-etsy-manages-https-an... ) But it was wwaayy too much for a small startup like me. I can think of a manual way of course.

For NGINX and Apache it's a shell script away. The dehyrated shell client is Let's Encrypt/ACME compatible. It can read from a domains.txt file listing individual certificates per line. There's a hook.sh that you can modify to get dehydrated to deploy the script. All you'd have to do is get whatever script you currently use to provision the custom domains, to add the domains.txt and run dehyrated --cron.

There's plenty of pre-written deployment scripts for it, check the wiki and Google. https://github.com/lukas2511/dehydrated

Failing that... If you're using Apache, it's on its way to natively supporting Let's Encrypt certificates for fully auto HTTPS https://letsencrypt.org/2017/10/17/acme-support-in-apache-ht...

Hope that helps. If you're not comfortable doing it yourself, any dev/sysadmin should be able to cobble it together for a days consultancy.

Post reply on HN