Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nginx introduces native support for ACME protocol

blog.nginx.org

Post reply on HN
Print view View original

151–160 of 308 posts

Re: Nginx introduces native support for ACME protocol

#151

Post by cnst »

aoe6721 wrote: post #99

It was introduced long time ago in Angie fork with much better support.

Here's the docs for the Angie's version of the http_acme module:

https://en.angie.software/angie/docs/configuration/modules/h...

The original announcement of Angie ACME:

Angie, fork of Nginx, supports ACME - https://news.ycombinator.com/item?id=39838228 - March 27, 2024 (1 comment)

Per above, it looks like ACME support was released with Angie 1.5.0 on 2024-03-27.

BTW, if you don't care about ACME, and want the original nginx, then there's also the freenginx fork, too:

Freenginx: Core Nginx developer announces fork - https://news.ycombinator.com/item?id=39373327 - (1131 points) - Feb 14, 2024 (475 comments)

Re: Nginx introduces native support for ACME protocol

#152

Post by yupyupyups »

clvx wrote: post #13
Shank wrote: post #9

> The current preview implementation supports HTTP-01 challenges to verify the client’s domain ownership. DNS-01 is probably the most impactful for users of nginx that isn't public facing (i.e., via Nginx Proxy Manager). I really want to see DNS-01 land! I've always felt that it's also one of the cleanest because it's just updating some records and doesn't need to be directly tethered to what you're hosting.

But you have to have your dns api key loaded and many dns providers don’t allow api keys per zone. I do like it but a compromise could be awful.

It's time for DNS providers to start supporting TSIG + key management. This is a standardized way to manipulate DNS records, and has a very granular ACL.

We don't need 100s of custom APIs.

https://en.m.wikipedia.org/wiki/TSIG

Re: Nginx introduces native support for ACME protocol

#153

Post by jacooper »

qwertox wrote: post #97
clvx wrote: post #13

Earlier quoted context omitted.

But you have to have your dns api key loaded and many dns providers don’t allow api keys per zone. I do like it but a compromise could be awful.

You can make the NS record for the _acme-challenge.domain.tld point to another server which is under your control, that way you don't have to update the zone through your DNS hoster. That server then only needs to be able to resolve the challenges for those who query.

How?

Re: Nginx introduces native support for ACME protocol

#154

Post by 0x0000000 »

cpach wrote: post #150
0x0000000 wrote: post #147

Earlier quoted context omitted.

The ACME provider makes a query to the DNS server to validate the record exists and contains the right "funny string". Parent's question was whether that query is/can be made via DoH.

Perhaps I have poor imagination, but I fail to see why why it would matter?

Because nginx, as an HTTP server, could answer the query?

Re: Nginx introduces native support for ACME protocol

#155

Post by KronisLV »

roywashere wrote: post #7
johnisgood wrote: post #2

For now I will stick to what works (nginx + certbot), but I will give this a try. Anyone tried it? Caddy sounds interesting too, but I am afraid of switching because what I have works properly. :/

I like it!!! I am using Apache mod_md on Debian for personal project. That is working fine but when setting up a new site it somehow required two Apache restarts which is not super smooth

It's interesting that mod_md is so unknown: https://httpd.apache.org/docs/2.4/mod/mod_md.html

But also hey, now we have built-in ACME support in all the mainstream web servers: Nginx, Caddy and Apache2! Ofc Caddy will be the most polished, since that is one of its main selling points.

Re: Nginx introduces native support for ACME protocol

#157

Post by dwood_dev »

jacooper wrote: post #153
qwertox wrote: post #97

Earlier quoted context omitted.

You can make the NS record for the _acme-challenge.domain.tld point to another server which is under your control, that way you don't have to update the zone through your DNS hoster. That server then only needs to be able to resolve the challenges for those who query.

How?

Usually you just CNAME it.

You can cname _acme-challenge.foo.com to foo.bar.com.

Now, if when you do the DNS challenge, you make a TXT at foo.bar.com with the challenge response, through CNAME redirection, the TXT record is picked up as if it were directly at _acme-challenge.foo.com. You can now issue wildcard certs for anything for foo.com.

I have it on my backlog to build an automated solution to this later this year to handle this for hundreds of individual domains and then put the resulting certificates in AWS secrets manager.

I'm going to also see if I can make some sort of ACME proxy, so internal clients authenticate to me, but they cant control dns, so I make the requests on their behalf. We need to get prepared for ACME everywhere. In May 2026, its 200 day certs, it only goes down from there.

Re: Nginx introduces native support for ACME protocol

#158

Post by 9dev »

orblivion wrote: post #140
9dev wrote: post #40

Earlier quoted context omitted.

Certbot is a utility that can only be installed via snap. That crap won’t make it to our servers, and many other people view it the same way I do. So this change is most welcome.

That doesn't sound right to me. It's been in Debian and Ubuntu for a while: * https://packages.debian.org/bullseye/certbot * https://packages.ubuntu.com/jammy/certbot

Last I was concerned with, this was the situation:

https://github.com/certbot/certbot/issues/8345#issuecomment-...

That’s been three years though. The EFF/Certbot team has lost so much goodwill with me over that, I won’t go back.

Re: Nginx introduces native support for ACME protocol

#159

Post by Arrowmaster »

0x0000000 wrote: post #154
cpach wrote: post #150

Earlier quoted context omitted.

Perhaps I have poor imagination, but I fail to see why why it would matter?

Because nginx, as an HTTP server, could answer the query?

You want to build a DNS server into nginx so you can respond to DoH query's for the domain you are hosting on that nginx server?

Let's ignore that DoH is a client oriented protocol and there's no same way to only run a DoH server without an underlying DNS server. How do you plan to get the first certificate so the query to the DoH server doesn't get rejected for invalid certificate?

Re: Nginx introduces native support for ACME protocol

#160

Post by mholt »

selfmodruntime wrote: post #116
darkwater wrote: post #92

Earlier quoted context omitted.

Caddy is just for developers that want to publish/test the thing they write. For power users or infra admins, nginx is still much more valuable. And yes, I use Caddy in my home lab and it's nice and all but it's not really flexible as nginx is.

We use Caddy across hundreds of apps with 10s of millions of requests per day in production.

Oooh. Can you tell me more about this?
Post reply on HN