5 ms·

I hope to see more built-in integration with Apache and Nginx web servers.

infinisil 9y ago
NixOS [1] actually has really great nginx integration with just a single line [2]: enableACME = true; This automatically does the ACME thing and sets up systemd units to renew the certificate. Have been using it a while for my (sub)domains and it's worked really well. [1]: https://nixos.org/ https://nixos.org/ [2]: https://nixos.org/nixos/options.html#%3Cname%3E.enableacme https://nixos.org/nixos/options.html#%3Cname%3E.enableacme
tribaal 9y ago
I know it's not directly what you've asked for (it's neither apache nor nginx), but the Caddy webserver does just that - almost 0 configuration dealing of the ACME part, auto-redirection from http to https. You still need to tell it what your domain name is, but barely (there's some DNS plugins that make it truely 0 config). https://github.com/mholt/caddy https://github.com/mholt/caddy (I'm not affiliated, just a happy user)
- Shoothe 9y ago
  Does caddy still stop the server if it can't access Let's Encrypt service even though certificate is valid?
  - tialaramex 9y ago
    The bug you're thinking of was Caddy would refuse to /start/ if the certificate needed renewing and Let's Encrypt was down. They fixed that so that it has three weeks grace. Now only if you switch off the server wait until the cert has almost expired (say five days left) then switch it on, Caddy will go "eek, time to renew" and if Let's Encrypt is down it'll give up and the server doesn't start. This means either Let's Encrypt was down for longer than a decent summer vacation or you switched off your own web site for weeks. Neither of those is a good idea.
  - mholt 9y ago
    No, Caddy never did that. Caddy never stopped serving a site that it started serving. Only by shutting down the server (or sending the appropriate signal) would it stop serving the site.
xorcist 9y ago
Check out mod_md. It's upstreamed in Apache now.
robinwassen 9y ago
Setup for Apache with certbot was basically one command. Was even easier than copying and configuring existing SSL certificates. So think that qualifies as a good integration.
JosephRedfern 9y ago
The (beta) nginx certbot-auto module works flawlessly for me.

NixOS [1] actually has really great nginx integration with just a single line [2]: enableACME = true; This automatically does the ACME thing and sets up systemd units to renew the certificate. Have been using it a while for my (sub)domains and it's worked really well. [1]: https://nixos.org/ https://nixos.org/ [2]: https://nixos.org/nixos/options.html#%3Cname%3E.enableacme https://nixos.org/nixos/options.html#%3Cname%3E.enableacme

tribaal 9y ago

I know it's not directly what you've asked for (it's neither apache nor nginx), but the Caddy webserver does just that - almost 0 configuration dealing of the ACME part, auto-redirection from http to https. You still need to tell it what your domain name is, but barely (there's some DNS plugins that make it truely 0 config). https://github.com/mholt/caddy https://github.com/mholt/caddy (I'm not affiliated, just a happy user)

Shoothe 9y ago
Does caddy still stop the server if it can't access Let's Encrypt service even though certificate is valid?
- tialaramex 9y ago
  The bug you're thinking of was Caddy would refuse to /start/ if the certificate needed renewing and Let's Encrypt was down. They fixed that so that it has three weeks grace. Now only if you switch off the server wait until the cert has almost expired (say five days left) then switch it on, Caddy will go "eek, time to renew" and if Let's Encrypt is down it'll give up and the server doesn't start. This means either Let's Encrypt was down for longer than a decent summer vacation or you switched off your own web site for weeks. Neither of those is a good idea.
- mholt 9y ago
  No, Caddy never did that. Caddy never stopped serving a site that it started serving. Only by shutting down the server (or sending the appropriate signal) would it stop serving the site.

xorcist 9y ago

Check out mod_md. It's upstreamed in Apache now.

robinwassen 9y ago

Setup for Apache with certbot was basically one command. Was even easier than copying and configuring existing SSL certificates. So think that qualifies as a good integration.

JosephRedfern 9y ago

The (beta) nginx certbot-auto module works flawlessly for me.