Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How We Deliver Global SSL with Let's Encrypt

fly.io

Post reply on HN
Print view View original

21–30 of 68 posts

Re: How We Deliver Global SSL with Let's Encrypt

#21

Post by pfg »

mrkurt wrote: post #20
zAy0LfpBZLC8mAC wrote: post #19

Earlier quoted context omitted.

Erm ... you had people create TXT records? Why would you do that? Wouldn't people then have to manually update the TXT record on each certificate renew?! Why not have them create a DNAME, a delegation, or just two CNAMEs?

txt records are the only way to do the dns-01 challenge with certbot/Let's Encrypt. The http-01 challenge is simpler, we can get people setup with one CNAME/A-record. Once we're serving traffic, we can do all renewals with an http challenge and they don't need to change DNS ever again.

This is an often overlooked option, but you can indeed solve the DNS challenge by having someone create a CNAME record for _acme-challenge.example.com that points to a domain under your control, and then serve the TXT record needed to verify the challenge from that domain. acme-dns[1] provides a nice implementation of this idea, as well as a more detailed explanation.

[1]: https://github.com/joohoi/acme-dns

Re: How We Deliver Global SSL with Let's Encrypt

#22

Post by stevenwoo »

k__ wrote: post #7

LE is awesome. Clients want an SSL server and it lets me set it up in 10 minutes without additional costs.

Yes this is a delight compared to the old way of having to hand over $10 or whatever to someone for a certificate that one had to remember to renew in a timely fashion versus just using a cron job now with LE.

Re: How We Deliver Global SSL with Let's Encrypt

#23

Post by zAy0LfpBZLC8mAC »

mrkurt wrote: post #20
zAy0LfpBZLC8mAC wrote: post #19

Earlier quoted context omitted.

Erm ... you had people create TXT records? Why would you do that? Wouldn't people then have to manually update the TXT record on each certificate renew?! Why not have them create a DNAME, a delegation, or just two CNAMEs?

txt records are the only way to do the dns-01 challenge with certbot/Let's Encrypt. The http-01 challenge is simpler, we can get people setup with one CNAME/A-record. Once we're serving traffic, we can do all renewals with an http challenge and they don't need to change DNS ever again.

And A and AAAA records are the only way to do HTTP with web browsers ... so?!

What makes you think that CNAME or DNAME records are specific to A or AAAA records?!

Re: How We Deliver Global SSL with Let's Encrypt

#24

Post by geetfun »

mrkurt wrote: post #16
adrinavarro wrote: post #10

Earlier quoted context omitted.

I agree with the pricy bit. I've made a calculation, and it would cost me 1200$ a month to run what Cloudflare does for free. Now, I get that free is not an option. 50/100$ a month is probably OK. But that's beyond reasonable. And prices change depending on where people visit you from (!?)

I'm not sure what kind of app you're running, but our product/pricing are targeted almost entirely at SaaS apps that need multiple hostnames — which is $2500/mo min on CF: https://fly.io/mix/custom-hostnames It's really expensive to do that on top of CloudFlare, and most apps like that aren't using a tremendous amount of bandwidth. We're not _yet_ a great option as a general purpose CDN replacement (both pricing and…

Agree it is not a trivial task to build out the infrastructure for custom SSL. We’ve done it ourselves and it’s just now another service component we have to manage. ie. more time sink for something that isn’t our business core feature

For others who are reading this, the whole process involves reading and storing private keys using asymmetric ciphers and all that. Definitely more stuff than we’d like to be responsible for.

Will definitely keep an eye on fly.io for new features! Thanks

Re: How We Deliver Global SSL with Let's Encrypt

#25

Post by infogulch »

pfg wrote: post #21
mrkurt wrote: post #20

Earlier quoted context omitted.

txt records are the only way to do the dns-01 challenge with certbot/Let's Encrypt. The http-01 challenge is simpler, we can get people setup with one CNAME/A-record. Once we're serving traffic, we can do all renewals with an http challenge and they don't need to change DNS ever again.

This is an often overlooked option, but you can indeed solve the DNS challenge by having someone create a CNAME record for _acme-challenge.example.com that points to a domain under your control, and then serve the TXT record needed to verify the challenge from that domain. acme-dns[1] provides a nice implementation of this idea, as well as a more detailed explanation. [1]: https://github.com/joohoi/acme-dns

Whoa really? I didn't know this option existed. This would make these types of configurations a lot better.

Re: How We Deliver Global SSL with Let's Encrypt

#26

Post by zAy0LfpBZLC8mAC »

infogulch wrote: post #25
pfg wrote: post #21

Earlier quoted context omitted.

This is an often overlooked option, but you can indeed solve the DNS challenge by having someone create a CNAME record for _acme-challenge.example.com that points to a domain under your control, and then serve the TXT record needed to verify the challenge from that domain. acme-dns[1] provides a nice implementation of this idea, as well as a more detailed explanation. [1]: https://github.com/joohoi/acme-dns

Whoa really? I didn't know this option existed. This would make these types of configurations a lot better.

Sorry, not trying to mock you, but I'm really curious how you (or anyone else on this thread who seems to be surprised by the possibility) managed to not know.

I mean, assuming you do know that CNAMEs are a thing, this reads to me like "well, yes, HTTP can do redirects, but I didn't know you could also redirect requests for images!" ...

I guess what I am wondering is: What is/was your mental model of CNAMEs that they could redirect DNS resolution, but then it's somehow surprising that they can redirect DNS resolution!?!

Re: How We Deliver Global SSL with Let's Encrypt

#27

Post by mrkurt »

zAy0LfpBZLC8mAC wrote: post #23
mrkurt wrote: post #20

Earlier quoted context omitted.

txt records are the only way to do the dns-01 challenge with certbot/Let's Encrypt. The http-01 challenge is simpler, we can get people setup with one CNAME/A-record. Once we're serving traffic, we can do all renewals with an http challenge and they don't need to change DNS ever again.

And A and AAAA records are the only way to do HTTP with web browsers ... so?! What makes you think that CNAME or DNAME records are specific to A or AAAA records?!

I'm really struggling to understand what you're recommending. Will you explain how a DNAME works with the Lets Encrypt auth process in a way that makes it as simple as a single CNAME/a-record?

Re: How We Deliver Global SSL with Let's Encrypt

#28

Post by mrkurt »

zAy0LfpBZLC8mAC wrote: post #26
infogulch wrote: post #25

Earlier quoted context omitted.

Whoa really? I didn't know this option existed. This would make these types of configurations a lot better.

Sorry, not trying to mock you, but I'm really curious how you (or anyone else on this thread who seems to be surprised by the possibility) managed to not know. I mean, assuming you do know that CNAMEs are a thing, this reads to me like "well, yes, HTTP can do redirects, but I didn't know you could also redirect requests for images!" ... I guess what I am wondering is: What is/was your mental model of CNAMEs that they…

I don't think we'd considered a CNAME to redirect the specific txt records that Lets Encrypt requires. It's not intuitively obvious that they support redirects for those lookups.

Re: How We Deliver Global SSL with Let's Encrypt

#29

Post by mrkurt »

stevenwoo wrote: post #22
k__ wrote: post #7

LE is awesome. Clients want an SSL server and it lets me set it up in 10 minutes without additional costs.

Yes this is a delight compared to the old way of having to hand over $10 or whatever to someone for a certificate that one had to remember to renew in a timely fashion versus just using a cron job now with LE.

Right?! "Sure I won't think about this for a year, then I'll remember it 30 days before I need to have it fixed, it'll be great".

Re: How We Deliver Global SSL with Let's Encrypt

#30

Post by prdonahue »

geetfun wrote: post #8

Interesting product - fly.io It’s essentially a reverse proxy as a service. Sort of like Cloudflare but with what looks like a nicer API, and custom domain name SSL eg. for multi tenant apps. It was a bit pricy when I plugged in how many requests we get per month on our servers, easily in 5-figure per month. Having said that, internally we built most of their selling points already.

Our API for doing this is quite simple:

  POST https://api.cloudflare.com/client/v4/zones/:zone_id/custom_hostnames
  {
    "hostname":"app.example.com",
    "ssl": {
      "method":"http",
      "type":"dv"
    }
  }
In addition to "http" (described in this thread) we also support "cname" and "email" methods for validation. Some of our customers prefer these other methods as it lets us issue the certificates before /their/ customer points the CNAME over.

Once we receive the call we generate multiple certificates for each hostname: one SHA-2/ECDSA that's presented to modern browsers and one SHA-2/RSA that we serve to legacy ones that don't support ECC. (Let's Encrypt doesn't do SHA-2/ECDSA signing yet but plans to sometime next year.)

We also support uploading your own custom certificates for those that, e.g. see value in Extended Validation (EV):

  POST https://api.cloudflare.com/client/v4/zones/:zone_id/custom_hostnames
  {
    "hostname":"app.example.com",
    "ssl": { 
      "custom_certificate": "$MYCERT",
      "custom_key": "$MYKEY"
    }
  }
Where $MYCERT and $MYKEY are the PEM payloads with newlines removed.
Post reply on HN