How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern
1–10 of 23 posts
Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern
#2Where's the part where they donate to Let's Encrypt as a thank-you for making all this possible?
Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern
#3Where's the part where they donate to Let's Encrypt as a thank-you for making all this possible?
Head of Let's Encrypt here. They did, but did not mention it in the article.
Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern
#4I'd like to thank Etsy for writing this article. Let's Encrypt's availability makes large deployments easier, but they're still not actually all that easy to pull off in many cases. It takes a lot of thought and work to scale securely.
We at Let's Encrypt talk to a lot of large providers about large deployments and there's really nothing more helpful than being able to refer engineering teams to detailed accounts of previous efforts.
These writeups really make a difference because they accelerate other large deployments. The sooner those other large deployments happen, the sooner many more people will experience a more secure and privacy-respecting Web.
Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern
#5Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern
#6Was just talking with my boss a few weeks ago regarding how we might allow customers to use a custom domain name in the future. Was dreading that implementation but now it's looking a little brighter with this writeup. Thanks Etsy!
Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern
#7I've googled this subject a number of times over the years and this seems to be the most thorough answer. Thanks for providing it!
However, for a small startup (like mine), I think it's still a bit too much work to get this working. I know that there aren't any other "automated" options out there anyway. Perhaps one day. :)
Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern
#8I'd like to thank Etsy for writing this article. Let's Encrypt's availability makes large deployments easier, but they're still not actually all that easy to pull off in many cases. It takes a lot of thought and work to scale securely. We at Let's Encrypt talk to a lot of large providers about large deployments and there's really nothing more helpful than being able to refer engineering teams to detailed accounts of…
This is something that's on our "very soon" roadmap for customer domains at FastMail as well, so we're likewise very pleased to see a writeup.
Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern
#9It's a good article, but it's a bit light on some of the technical points. We tried doing something similar about a decade ago (before the widespread adoption of SNI) and ran into the classic connected name/host header mismatch problem. Here, it's not explained that client has to have a way to suggest which certificate it's going to validate, and that there wasn't always an answer for that problem.
Also curious to know more about their LB solution and how it scales. Encrypting everything isn't free if you're doing thousands of ECDH[E] handshakes per second to chase down that "A+" rating.
Re: How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern
#10>To connect all this together, our proxy hosts periodically query CertService for a list of recently modified custom domains. Each host then 1) fetches the new certificates from CertService, 2) writes them to disk, 3) regenerates a config like the one above, and 4) does a graceful restart of Apache. These restarts are staggered across our proxy pool so all but one of the hosts is available and receiving requests from the load balancer at any give time (fingers crossed).
How many pools are there? If you're having to restart apache every time you renew a cert, are they renewing certs in the background and then only restart apache when they have around a thousand renewed? If so, wouldn't the current running certs be revoked in that time? It seems like on-the-fly cert usage is something that could be made, if not already.