171–180 of 308 posts
Caddy & Traefik did it long, long ago (half a decade ago), and after half a decade, we finally have ngxin supporting it too. Great move though, finally I won't have to manually run certbot :pray:
Earlier quoted context omitted.
Perhaps I have poor imagination, but I fail to see why why it would matter?
Because nginx, as an HTTP server, could answer the query?
The problem with the big open-source companies is that they are always very late to understand and implement the most basic innovations that come out. Caddy & Traefik did it long, long ago (half a decade ago), and after half a decade, we finally have ngxin supporting it too. Great move though, finally I won't have to manually run certbot :pray:
So Nginx is just about 9 to 10 years late. Lol
I never saw it as a problem for nginx to just serve web content and let certbot handle cert renewals. Whatever happened to doing one thing well and making it composable? Fat tools that try to do everything inevitably suck at some important part.
Earlier quoted context omitted.
We use Caddy across hundreds of apps with 10s of millions of requests per day in production.
Oooh. Can you tell me more about this?
He’s curious where it’s being used outside of home labs and in small shops. Matt, it’s fantastic software and will only get better as go improves.
I used it in a proxy setup for ingress to kubernetes that’s overlayed across multiple clouds - for the government (prior admin, this admin killed it). I can’t tell you more information than that. Other than it goes WWW -> ALB -> Caddy Cluster * Other Cloud -> K8s Router -> K8s pod -> Fiber Golang service. :chefs kiss:
When a pod is registered to the K8s router, we fire off a request to the caddy cluster to register the route. Bam, we got traffic, we got TLS, we got magic. No downtime.
Earlier quoted context omitted.
You can make the NS record for the _acme-challenge.domain.tld point to another server which is under your control, that way you don't have to update the zone through your DNS hoster. That server then only needs to be able to resolve the challenges for those who query.
How?
There's a NS record so *.acme-dns.example.com delegates requests to it, so each of my hosts that need a cert have a public CNAME like _acme-challenge.www.example.com CNAME asdfasf.acme-dns.example.com which points back to the acme-dns server.
When setting up a new hostname/certificate, a REST request is sent to acme-dns to register a new username/password/subdomain which is fed to acme.sh. Then every time acme.sh needs to issue/renew the certificate it sends the TXT info to the internal acme-dns server, which in turn makes it available to the world.
Earlier quoted context omitted.
But you have to have your dns api key loaded and many dns providers don’t allow api keys per zone. I do like it but a compromise could be awful.
It's time for DNS providers to start supporting TSIG + key management. This is a standardized way to manipulate DNS records, and has a very granular ACL. We don't need 100s of custom APIs. https://en.m.wikipedia.org/wiki/TSIG
Earlier quoted context omitted.
You can make the NS record for the _acme-challenge.domain.tld point to another server which is under your control, that way you don't have to update the zone through your DNS hoster. That server then only needs to be able to resolve the challenges for those who query.
How?
Earlier quoted context omitted.
> If you want a non-trustworthy authority... go with a custom CA. It's intentionally difficult to do so. This is where I get rankled. In IT land, everything needs a valid certificate. The printer, the server, the hypervisor, the load balancer, the WAP’s UI, everything. That said, most things don’t require a publicly valid certificate. Perhaps Intermediate CA is the wrong phrase for what I’m looking for. Ideally it wo…
Well you can use an admin box and a script to request like 1000 different certs of different names through DNS-01. Copy the certs to the devices that need them. The big problem now is, you have ~5 days to constantly re-copy new certs and reboot the devices, thanks to LE's decision to be super annoying. If you want less annoying... pay for certs. Installing custom CA certs isn't that hard once you figure out how to do…
Automation is the goal, and right now internal PKI is far from automated like public-facing certs are. With ACME I can set-and-forget on public stuff that's not processing sensitive data or requires a premium certificate for, but internally it still seems like the only solution is an ADCA.
Earlier quoted context omitted.
> If you want a non-trustworthy authority... go with a custom CA. It's intentionally difficult to do so. This is where I get rankled. In IT land, everything needs a valid certificate. The printer, the server, the hypervisor, the load balancer, the WAP’s UI, everything. That said, most things don’t require a publicly valid certificate. Perhaps Intermediate CA is the wrong phrase for what I’m looking for. Ideally it wo…
Intermediates aren't a delegation mechanism as such. They're a way to navigate to the roots trust. The trust is always in the root itself. It's not an active directory / LDAP / tree type mechanism where you can say I trust things at this node level and below.