News for hackers. Stuff that matters.

A comment on Nginx Introduces Native Support for Acme Protocol. Parent comment

Re:Nginx Introduces Native Support for Acme Protocol by bityard on Wednesday August 13, 2025 @01:14PM (#44891127)
The advantage to HTTP validation is that it's simple. No messing with DNS or API keys. Just fire up your server software and tell it what your hostname is and everything else happens in the background automagically.
[ Parent | on HN ]
Re:Nginx Introduces Native Support for Acme Protocol by abcdefg12 on Wednesday August 13, 2025 @04:45PM (#44893627)
And you have two or more servers serving this domain you’re out of luck
[ Parent | on HN ]
Re:Nginx Introduces Native Support for Acme Protocol by lmz on Wednesday August 13, 2025 @08:58PM (#44895650)
And this is different from DNS how exactly? The key and resulting cert still needs to be distributed among your servers no matter which method is used.
[ Parent | on HN ]
Re:Nginx Introduces Native Support for Acme Protocol by cpach on Thursday August 14, 2025 @01:48AM (#44897122)
With dns-01, multiple servers could, independently of each other, fetch a certificate for the same set of hostnames. Not sure if it’s a good idea though.
[ Parent | on HN ]
Re:Nginx Introduces Native Support for Acme Protocol by lmz on Thursday August 14, 2025 @11:17PM (#44908263)
Multiple keys and certs for the same hostname? Will the CA even issue that?
[ Parent | on HN ]
Re:Nginx Introduces Native Support for Acme Protocol by cpach on Friday August 15, 2025 @03:05AM (#44909409)
I guess it depends on the CA, but some do. Let’s Encrypt does, for example. I guess it’s useful for HA deployments, where load balancers might be spread out across multiple datacenters and stuff like that.

NB that rate limits apply https://letsencrypt.org/docs/rate-limits/

[ Parent | on HN ]
Re:Nginx Introduces Native Support for Acme Protocol by account42 on Thursday August 14, 2025 @05:03AM (#44898334)
Not really, just forward .well-known/acme-challenge/* requests to a single server or otherwise make sure that the challenge responses are served from all instances.
[ Parent | on HN ]