Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How We Deliver Global SSL with Let's Encrypt

fly.io

Post reply on HN
Print view View original

41–50 of 68 posts

Re: How We Deliver Global SSL with Let's Encrypt

#41

Post by toomuchtodo »

mschuster91 wrote: post #33
stevenwoo wrote: post #22

Earlier quoted context omitted.

Yes this is a delight compared to the old way of having to hand over $10 or whatever to someone for a certificate that one had to remember to renew in a timely fashion versus just using a cron job now with LE.

Why use a cron job? I have certbot running in one Docker container, the .well-known route directing to the one dedicated Docker host running certbot, and whenever certbot renews the certificate, it writes the cert to the NAS share that is only mounted on the LBs and then triggers a SIGKILL to the haproxy docker containers (which causes haproxy to re-read the cert file and configuration). Fully automated, no cronjobs…

You just described a far more complicated setup then a simple cron job.

Re: How We Deliver Global SSL with Let's Encrypt

#42

Post by nodejscloud »

mrkurt wrote: post #39
nodesocket wrote: post #35

Sorry a little off topic, but any idea when Let's Encrypt will (if ever) support wildcard SSL certs? We provision ( https://commando.io ) a subdomain for each of our accounts (thus thousands of subdomains) using a wildcard DNS A record. Willing to pay, as long as it is less than the $99 a year currently paying through NameCheap.

We can handle wildcards now, we just issue new certs when we see new subdomains (we have a 2500/wk rate limit from LE and will implement SANs if you need them). Feel free to email I'd you want to set it up. :)

Interesting, and you support DNS A record wildcard? Currently have around 6,300 subdomains.

Re: How We Deliver Global SSL with Let's Encrypt

#43

Post by matahwoosh »

nodejscloud wrote: post #42
mrkurt wrote: post #39

Earlier quoted context omitted.

We can handle wildcards now, we just issue new certs when we see new subdomains (we have a 2500/wk rate limit from LE and will implement SANs if you need them). Feel free to email I'd you want to set it up. :)

Interesting, and you support DNS A record wildcard? Currently have around 6,300 subdomains.

Yeah A/CNAME to us and then you can use our API to issue certs of all subdomains or if you have a wildcard cert already you can upload that with us. Either way works :)

Re: How We Deliver Global SSL with Let's Encrypt

#44

Post by LogicX »

adrinavarro wrote: post #10
geetfun wrote: post #8

Interesting product - fly.io It’s essentially a reverse proxy as a service. Sort of like Cloudflare but with what looks like a nicer API, and custom domain name SSL eg. for multi tenant apps. It was a bit pricy when I plugged in how many requests we get per month on our servers, easily in 5-figure per month. Having said that, internally we built most of their selling points already.

I agree with the pricy bit. I've made a calculation, and it would cost me 1200$ a month to run what Cloudflare does for free. Now, I get that free is not an option. 50/100$ a month is probably OK. But that's beyond reasonable. And prices change depending on where people visit you from (!?)

We do custom domains for customers with SSL through netlify - though only an option if you have a static site.

Re: How We Deliver Global SSL with Let's Encrypt

#45

Post by mrkurt »

matahwoosh wrote: post #43
nodejscloud wrote: post #42

Earlier quoted context omitted.

Interesting, and you support DNS A record wildcard? Currently have around 6,300 subdomains.

Yeah A/CNAME to us and then you can use our API to issue certs of all subdomains or if you have a wildcard cert already you can upload that with us. Either way works :)

You could actually install the wildcard cert, then we can slowly backfill with LE certs. And when LE does wildcards we'll just switch to one of those.

Re: How We Deliver Global SSL with Let's Encrypt

#46

Post by stevenwoo »

mschuster91 wrote: post #33
stevenwoo wrote: post #22

Earlier quoted context omitted.

Yes this is a delight compared to the old way of having to hand over $10 or whatever to someone for a certificate that one had to remember to renew in a timely fashion versus just using a cron job now with LE.

Why use a cron job? I have certbot running in one Docker container, the .well-known route directing to the one dedicated Docker host running certbot, and whenever certbot renews the certificate, it writes the cert to the NAS share that is only mounted on the LBs and then triggers a SIGKILL to the haproxy docker containers (which causes haproxy to re-read the cert file and configuration). Fully automated, no cronjobs…

Thank you for explaining the details of an alternative method. I have not advanced that far in my deployment skills, yet!

Re: How We Deliver Global SSL with Let's Encrypt

#47

Post by TheMissingPiece »

LogicX wrote: post #44
adrinavarro wrote: post #10

Earlier quoted context omitted.

I agree with the pricy bit. I've made a calculation, and it would cost me 1200$ a month to run what Cloudflare does for free. Now, I get that free is not an option. 50/100$ a month is probably OK. But that's beyond reasonable. And prices change depending on where people visit you from (!?)

We do custom domains for customers with SSL through netlify - though only an option if you have a static site.

Hey, I work at Fly, too. We have a built-in Netlify integration... If you configure your domain with Fly, you can use it as a custom domain for a Netlify, but also serve any other content on arbitrary sub paths. Here's more about the Netlify integration :) https://fly.io/articles/fly-netlify-explosive-static/

Re: How We Deliver Global SSL with Let's Encrypt

#48

Post by defined »

mschuster91 wrote: post #33
stevenwoo wrote: post #22

Earlier quoted context omitted.

Yes this is a delight compared to the old way of having to hand over $10 or whatever to someone for a certificate that one had to remember to renew in a timely fashion versus just using a cron job now with LE.

Why use a cron job? I have certbot running in one Docker container, the .well-known route directing to the one dedicated Docker host running certbot, and whenever certbot renews the certificate, it writes the cert to the NAS share that is only mounted on the LBs and then triggers a SIGKILL to the haproxy docker containers (which causes haproxy to re-read the cert file and configuration). Fully automated, no cronjobs…

Well, depending on how you install certbot, it sets up a cron job automatically for you (on Debian, anyway). It's no big deal - it just creates the cron file /etc/cron.d/certbot.

I'm curious as to how you get certbot to renew automatically without a cron job or some sort of script in the Docker container that periodically runs 'certbot renew'.

Re: How We Deliver Global SSL with Let's Encrypt

#49

Post by moulidorai »

On a side-note, ManageEngine Key Manager Plus can automate certificate management (request, acquire, deploy, track and renew) for public facing websites.

Video link: https://www.youtube.com/watch?v=oYelZided-E https://www.manageengine.com/key-manager/

Disclaimer: *I work for ManageEngine

Post reply on HN