Re:Another free CA as an alternative to Let's Encrypt
by TekMol on Friday August 20, 2021 @12:50PM
(#28248235)
Even more moving parts you need to set up and maintain.
It introduces a 4th party you depend on. Now you have:
1: The datacenter where your application runs
2: The DNS server
3: Let's Encrypt
4: The "DNS provider with a better API"
Re:Another free CA as an alternative to Let's Encrypt
by rossy on Friday August 20, 2021 @10:07PM
(#28253445)
The "DNS provider with a better API" can be your own bind9 server on the same machine as certbot, updated with RFC 2136. Completely standard, no changing APIs, no 4th party, no maintenance. I set up a server like this at work and haven't touched it for a year and a half.
Re:Another free CA as an alternative to Let's Encrypt
by gunapologist99 on Saturday August 21, 2021 @11:31AM
(#28257783)
bind hasn't exactly had a flawless security history...
(also hope that not touching it means you've automated security updates at least)
In this mode you manually configure a CNAME record once like "_acme-challenge.important.example => _acme-challenge.lessimportant.example" and then setup your client with DNS API keys for the lessimportant.example domain. You still get valid certs for your important domain without exposing creds for it.
A leaked key would prevent attackers from changing your important DNS records, but they could still generate valid certs for your important domain.
We bought a cheap domain (~$14/y) for this purpose and hooked it up to a DNS provider with a better API than our main provider. It has worked great and gives some peace of mind.
[0]: https://cert-manager.io/docs/configuration/acme/dns01/#deleg...