4 ms·
On AWS, you can also use https://github.com/alex/letsencrypt-aws https://github.com/alex/letsencrypt-aws - it works great if you're using both Route 53 and ELB.
by ak217 10y ago
On AWS, you can also use https://github.com/alex/letsencrypt-aws https://github.com/alex/letsencrypt-aws - it works great if you're using both Route 53 and ELB. It uses the dns-01 challenge, which is out-of-band - it adds a text record to your DNS instead of needing to inject content into your server. I prefer that approach.
- tacos 10y agoOn AWS you can get free SSL certificates from AWS. https://aws.amazon.com/certificate-manager/ https://aws.amazon.com/certificate-manager/
- ecaron 10y agoOnly free if you have Elastic Load Balancer running for each domain. If you're hosting a dozen micro-sites on a box, the Certificate Manager path gets a little expensive /me looks at his February bill and remembers the lesson all too well
- tacos 10y agoEven cheapo static S3 sites are free if they're behind CloudFront.
- themartorana 10y agoAlso free for static sites hosted on Cloudfront. Doesn't solve your problem, just thought I'd mention it in the interest of possible interest.
- wgjordan 10y agoConsidering alex/letsencrypt-aws is also designed specifically for ELB, I think the comparison to ACM is appropriate. From what I can tell, the only reasons to use alex/letsencrypt-aws (IAM certificates) instead of AWS Certificate Manager are if you're either 1, provisioning ELBs in a region other than us-east-1 and unable to wait for Amazon to roll out ACM to other regions; or 2, subsequently applying the same certificate to other resources in addition to ELB+CloudFront (e.g., a standalone EC2 instance running nginx or apache).
- lubos 10y agoNot sure I understand this pricing implication. Did you run separate ELB for each domain name?
- ak217 10y agoUnfortunately, right now ACM only works with CloudFront distributions or with ELBs in us-east-1. If you're running ELBs in another region, you can't use ACM on them.
- untog 10y agoUnfortunately doesn't work with AWS Lambda/API Gateway. Especially odd as Lambda has Cloudfront on the top of it, but shrug. Unfortunately it looks as though letsencrypt-aws won't either.
- desdiv 10y agoWould it be possible to use letsencrypt-aws on a AWS Lambda + API Gateway + Route 53 setup?
- wgjordan 10y agoletsencrypt-aws looks to be designed specifically to automate updating ELB certificates, and doesn't seem quite as suitable for provisioning certificates for standalone EC2 instances, for example. I've had good results using https://github.com/sorah/acmesmith https://github.com/sorah/acmesmith which also uses the dns-01 challenge via Route53, but saves certificates to an S3 bucket that can be fetched from any EC2 instance granted the proper permissions.
- psadauskas 10y agoI also wrote a tool to automate this, using Ruby. Rather than an all-in-one magic solution, it is just a set of tools intended to be easy to modify to fit in to your existing workflow/app. https://github.com/paul/letsencrypt-route53 https://github.com/paul/letsencrypt-route53
- StavrosK 10y agoDoes anyone know if the DNS challenge changes every renewal, or if I can leave it there forever and have renewals work?
- pfg 10y agoACME defines an authorization object, which is created for every FQDN on a certificate. Part of this object is a randomized token. A valid authz object (i.e. one for which you have solved a challenge by, say, creating a TXT record with the token) allows you to request (any number of) certificates for the FQDN until the expiration date of the object is reached (10 months in case of Let's Encrypt). So basically you can get up to 13 months worth of certificates out of one token/solved challenge. That being said, none of the clients I'm aware of currently reuse authorizations - they create a new one during renewal, which would result in a new token.
- StavrosK 10y agoAh, thanks. So this is not really that useful, since I can't keep reusing the same object. I guess I'll have to stick with the webroot method, too bad.