Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How We Deliver Global SSL with Let's Encrypt

fly.io

Post reply on HN
Print view View original

61–68 of 68 posts

Re: How We Deliver Global SSL with Let's Encrypt

#61

Post by toast0 »

pfg wrote: post #21
mrkurt wrote: post #20

Earlier quoted context omitted.

txt records are the only way to do the dns-01 challenge with certbot/Let's Encrypt. The http-01 challenge is simpler, we can get people setup with one CNAME/A-record. Once we're serving traffic, we can do all renewals with an http challenge and they don't need to change DNS ever again.

This is an often overlooked option, but you can indeed solve the DNS challenge by having someone create a CNAME record for _acme-challenge.example.com that points to a domain under your control, and then serve the TXT record needed to verify the challenge from that domain. acme-dns[1] provides a nice implementation of this idea, as well as a more detailed explanation. [1]: https://github.com/joohoi/acme-dns

You could also have them delegate the _acme-challenge with an NS record

Re: How We Deliver Global SSL with Let's Encrypt

#62

Post by stronglikedan »

nailer wrote: post #57
mcny wrote: post #56

Earlier quoted context omitted.

We wouldn't need to have this conversation if the title said TLS.

You're correct, but you're fighting an uphill battle: https://certsimple.com/blog/ssl-or-tls

When talking to management, I try to avoid the acronyms (SSL, TLS, HTTPS, etc.), and in this case, I've coined a phrase that I find be equally understood by management, devops, and sysadmins alike. I tell them that we need to "encrypt server X with a secure certificate" (or "secure cert" depending who I'm talking to, which is as short as the shortest acronym syllable-wise). It's vague enough to cover the spectrum of acronyms in a timeless (for the foreseeable future) way, but unambiguous enough that everyone understands.

Re: How We Deliver Global SSL with Let's Encrypt

#63

Post by apple4ever »

mrkurt wrote: post #29
stevenwoo wrote: post #22

Earlier quoted context omitted.

Yes this is a delight compared to the old way of having to hand over $10 or whatever to someone for a certificate that one had to remember to renew in a timely fashion versus just using a cron job now with LE.

Right?! "Sure I won't think about this for a year, then I'll remember it 30 days before I need to have it fixed, it'll be great".

Or "I won't have to think about this for three years, and everything will keep working during that time, and I don't have to worry about a cron job failing"

I don't mind offering 90 day certificates, but requiring it goes against the offered reason of LE to expand HTTPS.

Re: How We Deliver Global SSL with Let's Encrypt

#66

Post by matahwoosh »

matahwoosh wrote: post #65
anubhavmishra wrote: post #64

Completely unrelated, what is the blog framework / cms you are using the the fly.io blog? It is amazing!

Thanks! We're using ghost.org and of course all our illustrations are done by Annie ( https://twitter.com/annieruygt ) :)

Oh, and we use the basic Ghost theme, Casper, with some design tweaks.

Re: How We Deliver Global SSL with Let's Encrypt

#67

Post by corobo »

sfeng wrote: post #12
geetfun wrote: post #8

Interesting product - fly.io It’s essentially a reverse proxy as a service. Sort of like Cloudflare but with what looks like a nicer API, and custom domain name SSL eg. for multi tenant apps. It was a bit pricy when I plugged in how many requests we get per month on our servers, easily in 5-figure per month. Having said that, internally we built most of their selling points already.

Custom domain name SSL is also provided by Cloudflare, it's called "SSL for SaaS".

I’m almost certain I heard it was only available on their enterprise plan so you’re looking at a couple grand plus per month minimum

Re: How We Deliver Global SSL with Let's Encrypt

#68

Post by anubhavmishra »

matahwoosh wrote: post #66
matahwoosh wrote: post #65

Earlier quoted context omitted.

Thanks! We're using ghost.org and of course all our illustrations are done by Annie ( https://twitter.com/annieruygt ) :)

Oh, and we use the basic Ghost theme, Casper, with some design tweaks.

Thanks for the insight! Really appreciate it!
Post reply on HN