Supporting Let’s Encrypt, the nonprofit making HTTPS free for all

Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by Saris on Monday June 14, 2021 @09:56PM (#27510499)

>In order to avoid this issue, ACME requires your web server to communicate with an external service provider to sign the certificate. But now you're dependent on Lets Encrypt being able to access your server!

Only if you're using the HTTP challenge, the DNS challenge is (IMO at least) much simpler, easier, doesn't require any services open to the internet so can work in a LAN, and can issue wildcard certs too.

If you use a webserver like Caddy as well, then your SSL certs are done automatically without you needing to do much of anything at all.

[ Parent | on HN ]

Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by squiggleblaz on Tuesday June 15, 2021 @04:35PM (#27521156)

That's true, and instead of verifying that Lets Encrypt can contact your server, they verify that you can control the DNS. It isn't compatible with least privilege though, is it?

Either every box that wants to use SSL has to be capable of changing DNS settings, or you need a central box that generates secrets and securely transmits them to the servers.

I have domain names which I am authorised to serve content on, but not authorised to manipulate DNS for (but they're all exposed to the internet, so not relevant to the limitation - but probably the reason I overlooked the blindingly obvious solution)

[ Parent | on HN ]

Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by gravypod on Monday June 14, 2021 @11:42PM (#27511029)

Super agree with this comment. Been using Caddy with DNS and it's been amazing.

[ Parent | on HN ]