10 ms·
ACME Support in Apache HTTP Server Project
- lol768 9y agoI'm curious, which email does it use to register with? I didn't see one in the config file.
- jaas 9y agoSupplying an email address to Let's Encrypt is optional.
- tialaramex 9y ago... but if you don't supply one of course Let's Encrypt won't notify you about anything. So if you aren't paying attention you may get blind-sided by any future change, particularly if your use case is weird e.g. you can only pass http-01 by HTTP 301 redirecting to a machine with a completely different hostname, works today, could get outlawed as dangerous one day and they'd have the records to show you're going to be affected, but no way to automatically warn you.
- mholt 9y agoI recommend always monitoring server logs as a last line of defense (or first, honestly) for these kinds of things.
- Ajedi32 9y agoDo Apache's server logs notify you if your cert is about to expire, but hasn't yet?
- mholt 9y agoI doubt it does in general, but mod_md does have a pretty chatty log if you enable it. Haven't tested this specifically, but I assume it prints something around renewal time.
- majewsky 9y agoExpiration dates on your TLS certs is usually something that you want to monitor and alert on anyway. I'd actually build the monitoring separately from the renewal process, just in case that the renewal process doesn't notice that it fails.
- DonbunEf7 9y agoAs a good first step, it's easy to configure the Prometheus blackbox exporter (or your TLS-supporting blackbox scraper of choice) to report the TLS cert expiry date; I have an alert which pages me if a TLS cert will expire in a week or sooner based on this.
- Ajedi32 9y ago[It uses the value of the global ServerAdmin setting][1]: > There are 2 additional settings that are necessary for a Managed Domain: ServerAdmin and MDCertificateAgreement. The mail address of ServerAdmin is used to register at the CA (Let's Encrypt by default). The CA may use it to notify you about changes in its service or status of your certificates. [1]: https://httpd.apache.org/docs/trunk/mod/mod_md.html#manageddomain https://httpd.apache.org/docs/trunk/mod/mod_md.html#managedd...
- Ajedi32 9y agoThis is going to be huge for HTTPS adoption on the web. In the future all web servers should have this feature. I wonder which will be next? IIS? Nginx?
- icebraining 9y agoKlaus Krapfenbauer, a participant of Mozilla Winter Of Security, already implemented a PoC module for Nginx: https://github.com/mozilla/mwos-letsencrypt-2015 https://github.com/mozilla/mwos-letsencrypt-2015 Unfortunately, it seems to be very dead.
- apple4ever 9y agoThat sucks. Besides the dumb low cert expiration length, built in support for Nginx is why I haven't adopted Let's Encrypt.
- jjeaff 9y agoThe low cert expiration date is by design. If you don't have a script renewing it automatically, you aren't doing it right.
- deleted 9y ago[deleted]
- subway 9y agoNginx already has this via OpenResty and a script: https://github.com/GUI/lua-resty-auto-ssl https://github.com/GUI/lua-resty-auto-ssl
- NicoJuicy 9y agoIIS has support through a powershell script
- newman314 9y ago
- cholmon 9y agoI'm curious how renewals will be handled. According to https://github.com/icing/mod_md/wiki#no-auto-restart-when-started-as-root https://github.com/icing/mod_md/wiki#no-auto-restart-when-st... "...you have to manually restart httpd for any certificate changes to take effect." It's easy enough to have a daily cronjob that just reloads Apache unconditionally, but that feels dirty.
- jimminy 9y agoThe same thing is required of nginx. I personally have a cron script set up on my domain gateway to update certificates once a month and reload nginx, at the end. Total unavailability is about .5 sec once a month.
- askz 9y agoReload process in nginx isn't graceful?
- gtirloni 9y agoIt certainly is. http://nginx.org/en/docs/beginners_guide.html#control http://nginx.org/en/docs/beginners_guide.html#control
- jimminy 9y agoIt is. I hadn't even looked into it, because I set the job to off hours and the domains have low enough volume even a non-graceful reload wouldn't effect anything. Thanks for asking, because now I know. I was just assuming the same lag I see in the CLI.
- deleted 9y ago[deleted]
- ridruejo 9y agoApache supports graceful restarts, in which new children processes are spawned and old ones replaced without dropping existing connections
- jpb0104 9y agoThis is awesome. We're having early success with https://github.com/GUI/lua-resty-auto-ssl https://github.com/GUI/lua-resty-auto-ssl + https://openresty.org/ https://openresty.org/ to support thousands of custom domains.
- throwaway0071 9y agoThis is why I think projects like caddy/traefik shouldn't get too comfortable thinking Let's Encrypt / HTTPS support by default alone is going to differentiate them too much. They're one PR away from having their major selling point becoming irrelevant in the face of the competition. https://news.ycombinator.com/item?id=15433463 https://news.ycombinator.com/item?id=15433463
- rhencke 9y agoWhere do you see evidence of projects like Caddy getting too comfortable thinking Let's Encrypt/HTTPS support by default alone is going to differentiate them?
- stephenr 9y agoThe author (mholt) replied above and the 'district advantage' he identified for caddy, his own product was: > Caddy is the only server, even in the face of mod_md, to have fully automatic HTTPS by default In every discussion about Caddy I've seen, the same argument is made. Even when caddy would refuse to start (with valid certificates cached!) during the LE outage, the response was "but we do LE + TLS automatically". I still don't understand the concept of Caddy. The project seems inherently aimed at hobbyist's at best based on the idea that "its too hard to enable TLS in $Competition", but similarly they provide literally zero support for actually running Caddy - no sysvinit script, no systemd unit file, NOTHING. So tell me again who their target market is? People who can't enable TLS in <Apache/HAProxy/Hitch/Nginx> but can write a fucking unit file for systemd?
- thresh 9y agoAre there any other CAs that support ACME? Is ACME an Internet standard yet? Is that turning into monoculture?
- Ajedi32 9y agoACME is currently an IETF draft: https://tools.ietf.org/html/draft-ietf-acme-acme-07 https://tools.ietf.org/html/draft-ietf-acme-acme-07 As far as I know there's only one serious server-side implementation right now, and that's Let's Encrypt's open-source Boulder project: https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder
- tialaramex 9y agoOther CAs have made interested noises. Big ones have indicated to m.d.s.policy or CA/B that they are, at least, paying attention to the RFC process and some are participating in standardisation. ACME is at Working Group Last Call. Which means the IETF Working Group (people who thought this was interesting/ important) thinks it's finished but await feedback from outsiders who might not have realised this was coming or are too busy to look at in-progress designs. It will be published as a Standards Track RFC making it an "Internet Standard" in due course. A monoculture is at least an improvement over the Wild West we had prior to the Ten Blessed Methods. As recently as last year any CA could decide (on its own recognizance) that any method it chose was adequate to verify Domain Control, under a heading "Any Other Method" in the Baseline Requirements. If your CA was happy with a method so dumb nobody should possibly have used it, we'd have to find out about that, explain why it's dumb, and then you'd get told to stop doing it, often taking several weeks to achieve. A list of just ten explicit methods was written, the Ten Blessed Methods, and now CAs must use one or more of those. ACME implements three today, and is designed to be extensible. Some methods involve things like human lawyers writing physical letters, it is unlikely ACME will embrace that sort of manual process directly, but methods involving email or the WHOIS system could end up in there.
- dtzur 9y agoNow if they could only catch that Road Runner!
- baby 9y agoAbout the elephant in the room: Let’s Encrypt is becoming too big to fail. Wasn’t the point of open sourcing the whole protocol so that we could have multiple CAs like Lets Encrypt?
- scrollaway 9y agoACME is an open protocol. The LE servers are open source. You can run your own ACME server, the same code base as LE if you even wish, and it'll work fine with Caddy and Apache. And if you think it's too big to fail, I encourage you to start your own ACME-compatible sister CA to Let's Encrypt. And if you're now realizing you don't have the resources to do that, you just answered your own questions (but you can still donate to the EFF or to Let's Encrypt directly: https://letsencrypt.org/donate/ https://letsencrypt.org/donate/)
- djsumdog 9y agoThere are companies that run ACME internally so all their internal resources are secure. They can then push the company CA via group policies, or make them available for Linux devs to install. But you're right about trying to run another public LetsEncrypt style CA. Getting your root cert signed and into browsers is a major undertaking and I'm really glad we have LetsEncrypt. We might be tied to one big provider, but everything they've done is open if other people want to attempt it.
- parent5446 9y agoI thought the point of the process was to automate certificate issuance so that HTTPS could be deployed everywhere. I didn't think distributing CAs was part of that, or even desirable.
- diafygi 9y agoIt seems that running a free CA doesn't really have a business model, so capitalism isn't going to produce viable competitors. Additionally, other impact-focused people (non-profits, etc.), who would otherwise be willing to make a free CA, probably think Let's Encrypt is doing good enough, so why waste valuable time making the same thing when you could focus on having an impact elsewhere? I suspect this is a pretty common end result in public-good tasks that don't have business models. They naturally grow to be too big to fail. Some governments try to solve this by just absorbing the task and making it a part of the government's responsibilities. I doubt this would happen for Let's Encrypt, so I guess we'll be stuck with a too-big-to-fail non-profit until it fails, starts to suck too much, gets absorbed by the government, or someone figures out a business model.
- muppetman 9y agoGosh I can't believe how embarrassing this post is for the LE team. All that time, effort and hard work let down by using the "nano" editor in the Youtube video. (This is of course, fantastic news and great to see it'll be even easier for non-technical people to use HTTPS with little effort)
- convefefe 9y agoIt's good to see that Apache gets native support for this, I sincerely hope NGINX will follow.