News for hackers. Stuff that matters.

A comment on Chromium and Mozilla to enforce 1 year validity for TLS certificates. Parent comment

Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by polishdude20 on Sunday June 28, 2020 @11:51AM (#23669574)
Check out Caddy Server. It was only a few days ago when I was still managing my own certs and renewing them with a Cron job. Caddy now acts as my proxy for my various web domains and it handles certs automatically. Like literally you fill out a few lines in the config called a Caddy file and you do Caddy run and it gets the certs itself. And as long as it's running, it renews them automatically.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by dingaling on Sunday June 28, 2020 @03:52PM (#23671545)
Giving an Internet-connected program autonomous write-access to system-critical filesystems is not considered good practice in production environments.

Much better to have a separate central cert management system that handles renewals and pushes the certs outwards to the DMZ systems.

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by AlfeG on Sunday June 28, 2020 @03:54PM (#23671559)
This is true for enterprise, but for small business Caddy or Traefik is totally fine.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by mholt on Sunday June 28, 2020 @04:26PM (#23671770)
Caddy is good for enterprise use too because of its configurable, pluggable storage backends (doesn't have to be a file system). You can achieve the permission segmenting your company requires.

You can also use it as a certificate manager independently of a web server if you want.

[ Parent | on HN ]