Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's Encrypt and Nginx – State of the art secure web deployment

letsecure.me

Post reply on HN
Print view View original

21–30 of 85 posts

Re: Let's Encrypt and Nginx – State of the art secure web deployment

#22

Post by callahad »

tlrobinson wrote: post #20
diakritikal wrote: post #4

Just using caddy server seems a lot simpler...

Neat, I like that when started with no arguments/config it just serves the files in the current directory, but then you can customize it from there. I have "alias webserver='python -m SimpleHTTPServer'" in my shell config, but I think I'll switch to Caddy.

For local development, consider looking into devd (https://github.com/cortesi/devd). It's a single binary that supports things like livereload, network throttling, routing, and reverse proxying.

Re: Let's Encrypt and Nginx – State of the art secure web deployment

#23

Post by NovaS1X »

feylikurds wrote: post #10
gshulegaard wrote: post #6

Earlier quoted context omitted.

http://www.cyberciti.biz/faq/linux-unix-crontab-change-mailt...

So the default behavior is to only email root unless crontab is edited, therefore most people would never receive an email (in case of renew failure), if they only followed the instructions given. Otherwise mail is sent to the owner of the crontab.

A properly administered Linux system would be emailing root mail to a real email address unless monitored by another system. I've never worked in a professional environment where root mail was left unread at any point. Root aliases (excluding environments with other monitoring) are on the checklist for any basic image(server) deployment. It's a standard, well-adopted practice.

Re: Let's Encrypt and Nginx – State of the art secure web deployment

#24

Post by ivansavz »

The --webroot option doesn't work for my setup, so I need to shutdown nginx for 2-3 seconds and use the --standalone option. I set this as a CRON job that will run every two months. It's not elegant, but it's done.

Here's the modified script using certonly and the --force-renew flag.

    #!/bin/bash
    # Force-renew the "Let's Encrypt" certificates for a given domain
    # Run this as root as a BI-MONTHLY cron job
    export DOMAINS="yourdomain.com,www.yourdomain.com"
    export LOGFILE="/var/log/letsencrypt/renewal_yourdomain.log"

    echo "Stopping nginx temporarily to renvew certificates for $DOMAINS ..."
    service nginx stop

    echo "Calling /opt/letsencrypt/letsencrypt-auto certonly --standalone --force-renew -d $DOMAINS"
    if ! /opt/letsencrypt/letsencrypt-auto certonly --standalone --force-renew -d $DOMAINS > $LOGFILE 2>&1 ; then
        echo "certonly call failed, restarting nginx"
        service nginx start
        echo "LOG info:"
        cat $LOGFILE
        # TODO: email administrator...
        exit 1
    fi

    echo "certonly call succeeded, restarting nginx"
    service nginx start
Note: don't run this as a daily cron job since this has --force-renew...

Re: Let's Encrypt and Nginx – State of the art secure web deployment

#25

Post by schoen »

It scared me to see that the author recommended running

  curl http://nginx.org/keys/nginx_signing.key | sudo apt-key add -
(This adds a key or keys downloaded over an unauthenticated http connection to one's Debian keyring, allowing whatever keys the network sends back to authenticate any future package updates.) I wrote to the author with a note expressing my concern.

Re: Let's Encrypt and Nginx – State of the art secure web deployment

#27

Post by X-Istence »

sschueller wrote: post #13

I just use https://github.com/lukas2511/letsencrypt.sh/ single bash script. Add a config.sh and setup nginx alias. Then just add domains to the domains.txt and have the script run via cron daily. Finished

This is the script I use too. I have a hook that automatically restarts nginx, which fires only if a cert has changed. Very simple. Works very well.

Re: Let's Encrypt and Nginx – State of the art secure web deployment

#28

Post by mholt »

aroch wrote: post #26
diakritikal wrote: post #4

Just using caddy server seems a lot simpler...

You do need to restart Caddy in order to renew your cert, FWIW

Not true - Caddy has always renewed certificates automatically, and the latest version (0.8.2) renews without restarting. Relevant change: https://github.com/mholt/caddy/commit/11103bd8d68ed9d8dcd2fc...

Re: Let's Encrypt and Nginx – State of the art secure web deployment

#30

Post by schoen »

ivansavz wrote: post #24

The --webroot option doesn't work for my setup, so I need to shutdown nginx for 2-3 seconds and use the --standalone option. I set this as a CRON job that will run every two months. It's not elegant, but it's done. Here's the modified script using certonly and the --force-renew flag. #!/bin/bash # Force-renew the "Let's Encrypt" certificates for a given domain # Run this as root as a BI-MONTHLY cron job export DOMAIN…

Do you ever get problems with the socket still being in use after nginx is shut down?
Post reply on HN