9 ms·

This is my project, happy to answer questions or receive feedback. The goal was to let people experiment with getting a Let's Encrypt cert before the had to ins

by diafygi 11y ago

This is my project, happy to answer questions or receive feedback. The goal was to let people experiment with getting a Let's Encrypt cert before the had to install anything on their server. The static/unhosted property is to strengthen trust that nothing shady is going on here.

seivan 11y ago
So if you use the Keychain Assistant on OS X to generate a CSR, that should be enough? Or am I missing something here? Thanks for the service!
- diafygi 11y ago
  If they generate x509 compliant CSRs, then this should work. If not, please file an issue with the CSR, and I'll take a look to see why it's not parsing correctly.
  - seivan 11y ago
    Yup, though not sure I am doing it right. Printed the public key and that worked fine. Went to step 2 and pasted in my CSR, and that also worked fine. Basically Start Keychain -> "Request a Certificate from a Certificate Authority" -> Save to disk. Though weirdly enough, my public key generated from keygen didn't quite work, I actually had to use "openssl rsa -in myPrivateKey -pubout" for it to accept it. Why is that?
doughj3 11y ago
Thanks, diafygi! I used this a few weeks ago for a new domain and it was incredibly easy to get set up. Definitely appreciate you providing both Nginx and Apache isntructions as well. Great tool here!
pytrin 11y ago
Does this support wildcard subdomains? If not, would you be willing to add such support?
- deleted 11y ago
  [deleted]
- toupeira 11y ago
  This uses LetsEncrypt which doesn't support wildcard certificates yet: > Will Let’s Encrypt issue wildcard certificates? > We currently have no plans to do so, but it is a possibility in the future. Hopefully wildcards aren’t necessary for the vast majority of our potential subscribers because it should be easy to get and manage certificates for all subdomains. From https://community.letsencrypt.org/t/frequently-asked-questions-faq/26 https://community.letsencrypt.org/t/frequently-asked-questio...
  - pytrin 11y ago
    Unfortunately, that doesn't work with dynamic subdomains (i.e, domains assigned and edited by users). Hopefully they'll change their minds in the future - until then, I'll be paying for a commercial certificate
    - dyladan 11y ago
      You could always script the letsencrypt API and generate a new certificate on each subdomain generation.
      - pfg 11y ago
        That's correct, however there are rather aggressive rate limits in place right now that would make this hard for your typical SaaS-on-a-subdomain deployment if you have more than ~5 new signups per week. Plus, if SAN support is a concern, wildcards are preferable too.
        jrochkind1 11y ago
        The rate limits[1] I see documented are 500 registrations per 3 hours. That's a lot more than ~5 new signups per week. More like ~16800 new signups per week, no? [1] https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769 https://community.letsencrypt.org/t/rate-limits-for-lets-enc...
AndyMcConachie 11y ago
Once again I find myself looking at code you wrote and appreciating it. If we ever meet in real life I owe you some beers.
- diafygi 11y ago
  Thanks! Make sure you use https everywhere :) Also, my co-founder would shoot me if I didn't mention our startup is hiring.
  - masthead 11y ago
    Nice promo there! I will never be paying for the certificates again.
desireco42 11y ago
Thank you, I was looking through it trying to find your email to thank you. Process of getting ssl certs is not very simple and the way you laid it out for us/me really helped. My small site I used as example zeljko.rocks is now https secured.
mdip 11y ago
Just used it successfully (with some changes at the bottom -- converting the certificate so I could import it to Windows) to get a cert for my IIS web server. Worked like a champ!
andybak 11y ago
Can you limit the width of the main content container? Lines that long aren't nice to read. I'd probably bump the font size and switch to a nice sans serif if I were you. I almost pasted the page into something else to make it easier to read - before realising how short it was! It's still a touch off-putting as it is.

by diafygi 11y ago

seivan 11y ago

So if you use the Keychain Assistant on OS X to generate a CSR, that should be enough? Or am I missing something here? Thanks for the service!

diafygi 11y ago
If they generate x509 compliant CSRs, then this should work. If not, please file an issue with the CSR, and I'll take a look to see why it's not parsing correctly.
- seivan 11y ago
  Yup, though not sure I am doing it right. Printed the public key and that worked fine. Went to step 2 and pasted in my CSR, and that also worked fine. Basically Start Keychain -> "Request a Certificate from a Certificate Authority" -> Save to disk. Though weirdly enough, my public key generated from keygen didn't quite work, I actually had to use "openssl rsa -in myPrivateKey -pubout" for it to accept it. Why is that?

doughj3 11y ago

Thanks, diafygi! I used this a few weeks ago for a new domain and it was incredibly easy to get set up. Definitely appreciate you providing both Nginx and Apache isntructions as well. Great tool here!

pytrin 11y ago

Does this support wildcard subdomains? If not, would you be willing to add such support?

deleted 11y ago
[deleted]
toupeira 11y ago
This uses LetsEncrypt which doesn't support wildcard certificates yet: > Will Let’s Encrypt issue wildcard certificates? > We currently have no plans to do so, but it is a possibility in the future. Hopefully wildcards aren’t necessary for the vast majority of our potential subscribers because it should be easy to get and manage certificates for all subdomains. From https://community.letsencrypt.org/t/frequently-asked-questions-faq/26 https://community.letsencrypt.org/t/frequently-asked-questio...
- pytrin 11y ago
  Unfortunately, that doesn't work with dynamic subdomains (i.e, domains assigned and edited by users). Hopefully they'll change their minds in the future - until then, I'll be paying for a commercial certificate
  - dyladan 11y ago
    You could always script the letsencrypt API and generate a new certificate on each subdomain generation.
    - pfg 11y ago
      That's correct, however there are rather aggressive rate limits in place right now that would make this hard for your typical SaaS-on-a-subdomain deployment if you have more than ~5 new signups per week. Plus, if SAN support is a concern, wildcards are preferable too.
      - jrochkind1 11y ago
        The rate limits[1] I see documented are 500 registrations per 3 hours. That's a lot more than ~5 new signups per week. More like ~16800 new signups per week, no? [1] https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769 https://community.letsencrypt.org/t/rate-limits-for-lets-enc...

AndyMcConachie 11y ago

Once again I find myself looking at code you wrote and appreciating it. If we ever meet in real life I owe you some beers.

diafygi 11y ago
Thanks! Make sure you use https everywhere :) Also, my co-founder would shoot me if I didn't mention our startup is hiring.
- masthead 11y ago
  Nice promo there! I will never be paying for the certificates again.

desireco42 11y ago

Thank you, I was looking through it trying to find your email to thank you. Process of getting ssl certs is not very simple and the way you laid it out for us/me really helped. My small site I used as example zeljko.rocks is now https secured.

mdip 11y ago

Just used it successfully (with some changes at the bottom -- converting the certificate so I could import it to Windows) to get a cert for my IIS web server. Worked like a champ!

andybak 11y ago

Can you limit the width of the main content container? Lines that long aren't nice to read. I'd probably bump the font size and switch to a nice sans serif if I were you. I almost pasted the page into something else to make it easier to read - before realising how short it was! It's still a touch off-putting as it is.