All extensions disabled due to expiration of intermediate signing cert

Re:All extensions disabled due to expiration of intermediate... by rocqua on Saturday May 04, 2019 @03:38AM (#19825032)

Using http renewal requires listening on port 80 which, by default, requires root.

[ Parent | on HN ]

Re:All extensions disabled due to expiration of intermediate... by Whitestrake on Saturday May 04, 2019 @04:03AM (#19825104)

This is technically true, but contextually lacking.

acme-go/lego doesn't use HTTP validation unless you disable just about every other form of validation first. TLS-ALPN validation is much more likely, so port 443.

That said, it is very easy to allow software to bind to privileged ports without providing it root access; this has been solved for a very, very long time.

[ Parent | on HN ]

Re:All extensions disabled due to expiration of intermediate... by revvx on Saturday May 04, 2019 @08:53AM (#19826112)

You can just use the web server that is already running on the machine.

You (normally) don't want downtime in your website, so you just let your regular webserver serve the acme challenge instead of stopping it.

[ Parent | on HN ]