4 ms·

The auto mode just confused me. Every setup is different. Some use Apache, nginx, or both -- and proxied behind Haproxy or varnish. Then there's stuff like cpan

The auto mode just confused me. Every setup is different. Some use Apache, nginx, or both -- and proxied behind Haproxy or varnish. Then there's stuff like cpanel or virtualmin. So you got to expect any combination of those -- one or more, or combined. Their scripts would have to accommodate for so many different things. How could I anticipate what it would do? Am I missing something that would make this magically work? Installing a SSL certificate is relatively easy anyhow. It's one of the most common things you do with a http server.

newman314 10y ago
Use lego. It works brilliantly in DNS mode
newman314 10y ago
Use lego. It works brilliantly in DNS mode
tracker1 10y ago
Depends on where you want SSL termination, and if you want it federated out... The default Let's Encrypt project(s) integration tooling afaik isn't used by many people, but there have been a lot of tools to do more simple ACME integration into various web servers, reverse proxies and other configurations. It's pretty cool. I'm overall, very happy that it works at all... Some things I'd like to see... Namely, automatically allow higher thresholds for domains used/provided by dynamic dns providers such as freedns, that have more domains that may want/need to register than limits allow. Have a more transparent interface for requesting higher thresholds, or for submission of virtual tlds for those domains that offer subdomains to others.
- pfg 10y ago
  Dynamic DNS providers that are on the Public Suffix List are essentially treated like TLDs in terms of rate limiting, meaning each client subdomain has a separate counter. They should probably be on the PSL anyway; browsers rely on it for cookie scoping.
  - tracker1 10y ago
    True enough, but would be nice if it detected that the SOA IP corresponds to a public suffix dns provider. Also, not sure where to put public suffix list additions for such a provider... I was going to add bbs.io, as well as say the top 25 domains for freedns.afraid.org, but wasn't sure where to add them.
    - pfg 10y ago
      The process is described here[1]. It needs to be performed by the domain owner. [1]: https://publicsuffix.org/submit/ https://publicsuffix.org/submit/

newman314 10y ago

Use lego. It works brilliantly in DNS mode

newman314 10y ago

Use lego. It works brilliantly in DNS mode

tracker1 10y ago

Depends on where you want SSL termination, and if you want it federated out... The default Let's Encrypt project(s) integration tooling afaik isn't used by many people, but there have been a lot of tools to do more simple ACME integration into various web servers, reverse proxies and other configurations. It's pretty cool. I'm overall, very happy that it works at all... Some things I'd like to see... Namely, automatically allow higher thresholds for domains used/provided by dynamic dns providers such as freedns, that have more domains that may want/need to register than limits allow. Have a more transparent interface for requesting higher thresholds, or for submission of virtual tlds for those domains that offer subdomains to others.

pfg 10y ago
Dynamic DNS providers that are on the Public Suffix List are essentially treated like TLDs in terms of rate limiting, meaning each client subdomain has a separate counter. They should probably be on the PSL anyway; browsers rely on it for cookie scoping.
- tracker1 10y ago
  True enough, but would be nice if it detected that the SOA IP corresponds to a public suffix dns provider. Also, not sure where to put public suffix list additions for such a provider... I was going to add bbs.io, as well as say the top 25 domains for freedns.afraid.org, but wasn't sure where to add them.
  - pfg 10y ago
    The process is described here[1]. It needs to be performed by the domain owner. [1]: https://publicsuffix.org/submit/ https://publicsuffix.org/submit/