51–60 of 85 posts
Wrote about the process here: https://clay.fail/posts/hip-http2-using-docker/
Just using caddy server seems a lot simpler...
It scared me to see that the author recommended running curl http://nginx.org/keys/nginx_signing.key | sudo apt-key add - (This adds a key or keys downloaded over an unauthenticated http connection to one's Debian keyring, allowing whatever keys the network sends back to authenticate any future package updates.) I wrote to the author with a note expressing my concern.
What bugs me is how prevalent that has become. I'm looking at you Jenkins![0] [0] https://wiki.jenkins-ci.org/display/JENKINS/Installing+Jenki...
Also, anyone suggesting that this method of downloading and installing software is secure due to its use of HTTPS is incredibly reckless.
The --webroot option doesn't work for my setup, so I need to shutdown nginx for 2-3 seconds and use the --standalone option. I set this as a CRON job that will run every two months. It's not elegant, but it's done. Here's the modified script using certonly and the --force-renew flag. #!/bin/bash # Force-renew the "Let's Encrypt" certificates for a given domain # Run this as root as a BI-MONTHLY cron job export DOMAIN…
I'm curious: why doesn't webroot work for your setup?
Earlier quoted context omitted.
Yes, the API documentation is lacking especially with what we've gotten used to from Swagger markup and Stripe's API doc style. I have scoured for such an easy breakdown and found none. As a result I actually just implemented a new, clear, client for LetsEncrypt and have been documenting as I go. It's made me think we should have a Swagger or API Blueprint of the spec on github that everyone can keep up to date. What…
Are you referring to the server-side API the client is communicating with, or the internal API the client exposes? The former is documented in the ACME specification[1], currently being worked on by the IETF. There are many low-level ACME libraries for basically every language[2], and a pretty decent guide on writing your own client as well[3]. [1]: https://ietf-wg-acme.github.io/acme/ [2]: https://github.com/letsenc…
[0] https://tools.ietf.org/html/draft-ietf-acme-acme-02
[1] https://tools.ietf.org/rfcdiff?url2=draft-ietf-acme-acme-02....
Here's my notes on setting up LE on IIS if anyone one is interested, it's done by using Powershell/ Package manager.
//1. Install (you will get some security prompts) Install-Module -Name ACMESharp
Import-Module ACMESharp
Initialize-ACMEVault
New-ACMERegistration -Contacts mailto:somebody@example.org -AcceptTos
//2. Request the challange, this is for a website currently running on IIS. 'WebSiteRef ' refers to the name of the site within IIS
New-ACMEIdentifier -Dns demo.velox.io -Alias demo Complete-ACMEChallenge demo -ChallengeType http-01 -Handler iis -HandlerParameters @{ WebSiteRef = 'Demo' }
Submit-ACMEChallenge demo -ChallengeType http-01
//3. Create & download the certificate
New-ACMECertificate demo -Generate -Alias demoCert
Submit-ACMECertificate demoCert
Update-ACMECertificate demoCert
Get-ACMECertificate demoCert -ExportPkcs12 "C:\Users\USER\desktop\demoCert.pfx"
You can now install this on your server.
Recently went through a similar setup, but used Docker and some existing h2-friendly images. Think it's a nice way forward for deploying to production environments. Wrote about the process here: https://clay.fail/posts/hip-http2-using-docker/
Earlier quoted context omitted.
What bugs me is how prevalent that has become. I'm looking at you Jenkins![0] [0] https://wiki.jenkins-ci.org/display/JENKINS/Installing+Jenki...
The rust project also advocates this method of installing software on their download page. To their defense, however, they do offer gpg signatures for their tarballs, even if you need to dig around for a bit to find them. Also, anyone suggesting that this method of downloading and installing software is secure due to its use of HTTPS is incredibly reckless.
https://noncombatant.org/2014/03/03/downloading-software-saf...
(after what I think was a long time, the actual download links themselves are now HTTPS, although they're all still served -- along with the signatures -- from an HTTP page)
I'm certainly not going to defend the idea that HTTPS is enough authentication for software installations (I'm writing an article related to software transparency), but there's a pretty big bootstrap problem and infrastructure gap right now.