News for hackers. Stuff that matters.

A comment on Why I stopped using StartSSL (Hint: it involves a Chinese company). Parent comment

Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by sandGorgon on Tuesday February 16, 2016 @01:19AM (#11108224)
can you explain this ? I'm trying to bake letsencrypt certificates in my docker images and I am trying to figure out a way around the race condition (nginx needs a certificate to run <-> certificate needs nginx to run).
[ Parent | on HN ]
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by DanielDent on Tuesday February 16, 2016 @04:36AM (#11108783)
Here's one approach: https://github.com/DanielDent/docker-nginx-ssl-proxy

I use a temporary self-signed keypair, which then gets replaced when the certificate is issued.

[ Parent | on HN ]
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by imron on Tuesday February 16, 2016 @03:41AM (#11108594)
How about storing the letsencrypt certificates in a data-container/locally on the host and mapping those files to the nginx container when you start it?

For the very first time, you can use let's encrypt's manual verification process, but then have the let's encrypt client set up to renew certs automatically (possibly even from a separate container) using same data file mappings.

[ Parent | on HN ]
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by sandGorgon on Tuesday February 16, 2016 @10:55AM (#11110664)
which is why im preferring to spend 10$ on a certificate instead (or rather 85$ for a wildcard).
[ Parent | on HN ]
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by kccqzy on Tuesday February 16, 2016 @01:29AM (#11108258)
You can obtain a certificate by running let's encrypt's docker image, which seems to contain a python web server just to do the validation.
[ Parent | on HN ]
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by sandGorgon on Tuesday February 16, 2016 @03:00AM (#11108474)
cannot run a docker inside a docker. the problem is not running a webserver, the problem is the race condition which needs to be solved when docker starts up.
[ Parent | on HN ]
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by vacri on Tuesday February 16, 2016 @03:51AM (#11108622)
As a totally-naive-to-your-problem-particulars and totally-hacky suggestion, why not start nginx with a starter cert, then mv the new cert into position and reload nginx?
[ Parent | on HN ]
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by sandGorgon on Tuesday February 16, 2016 @10:56AM (#11110671)
exactly what I did - but then I bought a certificate from rapidssl for 10 bucks...
[ Parent | on HN ]
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by marcosdumay on Tuesday February 16, 2016 @08:42AM (#11109705)
Have an instance with plain-text http running only the Lets Encrypt challenge. Make an explicit rule for it on your load balancer, and deploy it first.
[ Parent | on HN ]