You Can't Follow Me

Re:You Can't Follow Me by jeroenhd on Thursday January 11, 2024 @05:27AM (#38950303)

Getting a CA into a Mastodon server is an adventure of its own. Setting up the CA isn't that hard even without smallstep (copy/paste three or four commands and you're good to start testing) but getting the CA working where it needs to work is a massive pain. Everything has a different certificate store, sometimes compiled into the binaries, and getting stuff talking to each other is a massive pain.

For browsers, importing certificates comes down to just searching "certificate" in the settings. It's everything else that's broken, in my experience.

[ Parent | on HN ]

Re:You Can't Follow Me by fuomag9 on Thursday January 11, 2024 @07:11AM (#38951183)

I agree. For example home assistant OS has a custom cert store that is reset on boot and there’s no way to make persistent modifications without recurring to hacks such as this one https://github.com/Athozs/hass-additional-ca

[ Parent | on HN ]

Re:You Can't Follow Me by plagiarist on Thursday January 11, 2024 @08:44AM (#38952062)

Enraging on a tool that offers user login from a webpage. You should be able to add DNS records to your gateway and not have to deal with public CAs to access it by name with TLS.

[ Parent | on HN ]

Re:You Can't Follow Me by shadowgovt on Thursday January 11, 2024 @07:31AM (#38951351)

Yep. As a datapoint: I set up my own Mastodon server behind a Cloudflare tunnel and completed every step except the cert, eventually opting to just tell Cloudflare to ignore the cert config.

The default solution doesn't work on a shared host where you don't have control over running your own services and opening your own ports, only serving static pages instead using a shared web server.

[ Parent | on HN ]