Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nginx introduces native support for ACME protocol

blog.nginx.org

Post reply on HN
Print view View original

291–300 of 308 posts

Re: Nginx introduces native support for ACME protocol

#291

Post by mholt »

selfmodruntime wrote: post #256
mholt wrote: post #160

Earlier quoted context omitted.

Oooh. Can you tell me more about this?

Sure. University / Government sector. I know quite some unis/projects in that field that switched to caddy, since gigantic ip ranges and deep subdomains with stakeholders of many different classes have certain PKI requirements and caddy makes using ACME easy. We deploy a self serving tool where people can generate EAB-Ids and Hmac keys for a sub domain they own. Complex root domain routing and complex dynamic rewrite…

Thank you, this is amazing feedback/info. Yeah, we think the Tailscale integration is pretty neat too!

Re: Nginx introduces native support for ACME protocol

#292

Post by Avamander »

thaumaturgy wrote: post #41

Good to see this. For those that weren't aware, there's been a low-effort solution with https://github.com/dehydrated-io/dehydrated , combined with a pretty simple couple of lines in your vhost config: location ^~ /.well-known/acme-challenge/ { alias ; } Dehydrated has been around for a while and is a great low-overhead option for http-01 renewal automation.

The same config also works with certbot. I've used it for years.

Re: Nginx introduces native support for ACME protocol

#293

Post by cpach »

jcgl wrote: post #278
cpach wrote: post #275

Earlier quoted context omitted.

Yup. There’s an RFC draft that addresses this dilemma. https://datatracker.ietf.org/doc/draft-ietf-acme-dns-account...

Afaiu, that's only a problem for trying to _delegate_ to multiple clients. But routine operation with multiple clients works just fine in my experience (doing multi-region load balancing). Multiple TXT records are created, I think (speaking off the top of my head).

Ah! I stand corrected.

Re: Nginx introduces native support for ACME protocol

#294

Post by jcgl »

cpach wrote: post #293
jcgl wrote: post #278

Earlier quoted context omitted.

Afaiu, that's only a problem for trying to _delegate_ to multiple clients. But routine operation with multiple clients works just fine in my experience (doing multi-region load balancing). Multiple TXT records are created, I think (speaking off the top of my head).

Ah! I stand corrected.

I wanted to quickly double-check my (albeit limited) experience against docs. The RFC[0] implies the possibility of what I described (provided a well-behaved ACME client that doesn't clobber other TXT records):

   2.  Query for TXT records for the validation domain name
   
   3.  Verify that the contents of one of the TXT records match the
       digest value
And then the certbot docs[2] show how it's a well-behaved client that wouldn't clobber TXT records from concurrent instances:

> You can have multiple TXT records in place for the same name. For instance, this might happen if you are validating a challenge for a wildcard and a non-wildcard certificate at the same time. However, you should make sure to clean up old TXT records, because if the response size gets too big Let’s Encrypt will start rejecting it. > ... > It works well even if you have multiple web servers.

That bit about "multiple webservers" is a little ambiguous, but I think the preceding line indicates clearly enough how everything is supposed to work.

[0] https://datatracker.ietf.org/doc/html/rfc8555#section-8.4

[1] https://letsencrypt.org/docs/challenge-types/#dns-01-challen...

Re: Nginx introduces native support for ACME protocol

#295

Post by reactordev »

jcgl wrote: post #207
reactordev wrote: post #135

Earlier quoted context omitted.

A tools value is in the eye of the beholder. Nginx has ceased being valuable to me when they decided to change licenses, go private equity, not adapt to orchestration needs, ignore http standards, and not release meaningful updates in a decade.

Private equity? Either there’s a story I’m missing, or you’re mischaracterizing F5 as PE.

Lookup Angie, freenginx, and the whole Rambler / F5 fiasco. Moscow feds involved and forced exploitation for profit.

Re: Nginx introduces native support for ACME protocol

#296

Post by lmz »

cpach wrote: post #204
lmz wrote: post #183

Earlier quoted context omitted.

And this is different from DNS how exactly? The key and resulting cert still needs to be distributed among your servers no matter which method is used.

With dns-01, multiple servers could, independently of each other, fetch a certificate for the same set of hostnames. Not sure if it’s a good idea though.

Multiple keys and certs for the same hostname? Will the CA even issue that?

Re: Nginx introduces native support for ACME protocol

#297

Post by cpach »

lmz wrote: post #296
cpach wrote: post #204

Earlier quoted context omitted.

With dns-01, multiple servers could, independently of each other, fetch a certificate for the same set of hostnames. Not sure if it’s a good idea though.

Multiple keys and certs for the same hostname? Will the CA even issue that?

I guess it depends on the CA, but some do. Let’s Encrypt does, for example. I guess it’s useful for HA deployments, where load balancers might be spread out across multiple datacenters and stuff like that.

NB that rate limits apply https://letsencrypt.org/docs/rate-limits/

Re: Nginx introduces native support for ACME protocol

#298

Post by stephenr »

francislavoie wrote: post #282
stephenr wrote: post #281

Earlier quoted context omitted.

The concern isn't that the same code exists, or even that it has odd unintended behaviour. The concern is that the author failed to understand why his batshit-crazy intended behaviour was a bad design from the start.

So you've never made mistakes in your life? Do you think children are irredeemable if they get a B on their tests in school? What a ridiculous take.

Making a mistake is generally considered "acceptable" if you learn from it and acknowledge the mistake.

The author did neither - he was steadfast that his approach was correct, and everyone else was wrong.

Re: Nginx introduces native support for ACME protocol

#299

Post by stephenr »

mholt wrote: post #285
stephenr wrote: post #246

Earlier quoted context omitted.

Given that Caddy has a history that includes choices like "refuse to start if LE cannot be contacted while a valid certificate exists on disk" I'm pretty happy to keep my certificate issuance separate from a web server. I need a tool to issue certs for a bunch of other services anyway, I don't really see how it became such a thing for people to want it embedded in their web server.

I remember you. You're just grumpy because you didn't think of it first. ;)

Top effort dispelling the claim that you make poor decisions mate.

Someone references when you made an ass-backwards decision, and insisted you were correct; your immediate response is not any kind of explanation about how you learnt to trust other people's opinions, or even acknowledging that you got it wrong - you resort to petty childlike attempts at insult.

Re: Nginx introduces native support for ACME protocol

#300

Post by dizhn »

grim_io wrote: post #23
thrown-0825 wrote: post #12

Earlier quoted context omitted.

Definitely. I use traefik for some stuff at home and will likely swap it out now.

I configure traefik by defining a few docker labels on the services themselves. No way I'm going back to using the horrible huge nginx config.

https://gist.github.com/omltcat/241ef622070ca0580f2876a7cfa7...

Some guy retrofitted caddy to use docker labels. It looks way too complicated for me but i don't know how easy/hard it is with traefik either.

Post reply on HN