Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nginx introduces native support for ACME protocol

blog.nginx.org

Post reply on HN
Print view View original

281–290 of 308 posts

Re: Nginx introduces native support for ACME protocol

#281

Post by stephenr »

francislavoie wrote: post #271
stephenr wrote: post #246

Earlier quoted context omitted.

Given that Caddy has a history that includes choices like "refuse to start if LE cannot be contacted while a valid certificate exists on disk" I'm pretty happy to keep my certificate issuance separate from a web server. I need a tool to issue certs for a bunch of other services anyway, I don't really see how it became such a thing for people to want it embedded in their web server.

As we repeat every time this comes up, this was literally 8 years ago when the project was in its infancy and the project author was in the middle of exams, and it has not been true since. Caddy has been rewritten from the ground up since then, and comparing it to those old versions is dishonest.

The concern isn't that the same code exists, or even that it has odd unintended behaviour.

The concern is that the author failed to understand why his batshit-crazy intended behaviour was a bad design from the start.

Re: Nginx introduces native support for ACME protocol

#282

Post by francislavoie »

stephenr wrote: post #281
francislavoie wrote: post #271

Earlier quoted context omitted.

As we repeat every time this comes up, this was literally 8 years ago when the project was in its infancy and the project author was in the middle of exams, and it has not been true since. Caddy has been rewritten from the ground up since then, and comparing it to those old versions is dishonest.

The concern isn't that the same code exists, or even that it has odd unintended behaviour. The concern is that the author failed to understand why his batshit-crazy intended behaviour was a bad design from the start.

So you've never made mistakes in your life? Do you think children are irredeemable if they get a B on their tests in school? What a ridiculous take.

Re: Nginx introduces native support for ACME protocol

#284

Post by mholt »

winter_blue wrote: post #173
kocial wrote: post #171

The problem with the big open-source companies is that they are always very late to understand and implement the most basic innovations that come out. Caddy & Traefik did it long, long ago (half a decade ago), and after half a decade, we finally have ngxin supporting it too. Great move though, finally I won't have to manually run certbot :pray:

Caddy did it almost a decade ago. IIRC it had some form of automatic Let’s Encrypt HTTPS back in 2016. So Nginx is just about 9 to 10 years late. Lol

2015 in fact. A decade ago.

Re: Nginx introduces native support for ACME protocol

#285

Post by mholt »

stephenr wrote: post #246
kocial wrote: post #171

The problem with the big open-source companies is that they are always very late to understand and implement the most basic innovations that come out. Caddy & Traefik did it long, long ago (half a decade ago), and after half a decade, we finally have ngxin supporting it too. Great move though, finally I won't have to manually run certbot :pray:

Given that Caddy has a history that includes choices like "refuse to start if LE cannot be contacted while a valid certificate exists on disk" I'm pretty happy to keep my certificate issuance separate from a web server. I need a tool to issue certs for a bunch of other services anyway, I don't really see how it became such a thing for people to want it embedded in their web server.

I remember you. You're just grumpy because you didn't think of it first. ;)

Re: Nginx introduces native support for ACME protocol

#286

Post by dizhn »

dwedge wrote: post #251
dizhn wrote: post #3

This is pretty big. Caddy had this forever but not everybody wants to use caddy. It'll probably eat into the user share of software like Traefik.

It's also been in Apache since 2018

That is pretty early. I had no idea Apache had this. I guess not many people are talking about apache anymore.

Re: Nginx introduces native support for ACME protocol

#288

Post by yjftsjthsd-h »

vivzkestrel wrote: post #222
yjftsjthsd-h wrote: post #217

Earlier quoted context omitted.

> you need certificates to start the NGINX server but you need the NGINX server to issue certificates? I just pre-populate with a self-signed cert to start, though I'd have to check how to do that in docker.

exactly! it all sounds easy unless you want to run stuff inside docker at which point there is a serious lack of documentation and resources

Okay, it seems like if you're using compose this is now doable: https://stackoverflow.com/questions/70322031/does-docker-com... So you'd make an init container that runs something like `test -f /certs/whatever.crt || openssl command to generate cert` and tell compose to run that before the real web server container.

Re: Nginx introduces native support for ACME protocol

#289

Post by geek_at »

klysm wrote: post #187
Shank wrote: post #9

> The current preview implementation supports HTTP-01 challenges to verify the client’s domain ownership. DNS-01 is probably the most impactful for users of nginx that isn't public facing (i.e., via Nginx Proxy Manager). I really want to see DNS-01 land! I've always felt that it's also one of the cleanest because it's just updating some records and doesn't need to be directly tethered to what you're hosting.

How does NGINX fit into that though?

I am using a bash script on my vps to get a wildcard certificate and just scp the cert to my other reverse proxies. Some using nginx but some Caddy or traefik

Wrote an article how to set it up https://blog.haschek.at/2023/letsencrypt-wildcard-cert.html

Re: Nginx introduces native support for ACME protocol

#290

Post by mholt »

reactordev wrote: post #268
reactordev wrote: post #175

Earlier quoted context omitted.

In case people are wondering, this is the author of Caddy. He’s curious where it’s being used outside of home labs and in small shops. Matt, it’s fantastic software and will only get better as go improves. I used it in a proxy setup for ingress to kubernetes that’s overlayed across multiple clouds - for the government (prior admin, this admin killed it). I can’t tell you more information than that. Other than it goes…

I almost forgot. Matt. We added a little sugar to Caddy for our cluster. Hashicorp's memberlist. So we can sync the records. It worked great. Sadly, I can't share it but it's rather trivial to implement.

Wonderful info, and feedback -- thank you so much. Happy that it works for you!
Post reply on HN