9 ms·

Glad to hear this! Let's Encrypt is such an amazing resource -- it single-handedly caused a leap in internet security as well as removing what was essentially a

Glad to hear this! Let's Encrypt is such an amazing resource -- it single-handedly caused a leap in internet security as well as removing what was essentially a artificially inflated (IMO) barrier to entry (for most people) to getting certs. Has anyone set up the new wildcard certs? If so, who did you choose as your DNS 01 Challenge[0] provider? I currently do DNS through a local provider and they don't have an API so it's been out of my reach.

DrPhish 8y ago
For wildcard certs, I run my own DNS infrastructure, so I just created the _acme-challenge records as indicated by the first run of certbot Are you unable to add arbitrary TXT records with your provider?
- hardwaresofton 8y ago
  I am, but I'm trying not to do it manually -- I actually use cert-manager[0] on a tiny kubernetes cluster -- which means when I make an Ingress for an application (app.example.com) (which does what it sounds like), watcher processes kick off and go get a cert for me with http 01 validation currently. This works thanks to cert-manager being able to automate the process of setting up the proper /.well-known/xxx route with access to kubernetes features. cert-manager also supports DNS 01, but of course they support the bigger providers (so they'll take some options and do the web requests to set up the TXT records)... I haven't looked into it a crazy amount (since in the end I can still just make multiple http 01 validated certs), but was just curious. [0]: https://github.com/jetstack/cert-manager/ https://github.com/jetstack/cert-manager/
  - MertsA 8y ago
    FWIW Personally I just use the DNS RFC2136 plugin for certbot. I use bind for DNS.
    - hardwaresofton 8y ago
      Could you expand on this? You run bind on your server, then you add your own server as an (additional?) nameserver to your domain's registrar?
kragniz 8y ago
You can also set up a CNAME record to delegate the challenges to a provider with a supported API.
- hardwaresofton 8y ago
  Thanks for the tip -- that sounds like a great way forward. I can't find any documentation on it however after checking the community page (https://community.letsencrypt.org/t/acme-v2-production-environment-wildcards/55578 https://community.letsencrypt.org/t/acme-v2-production-envir...)... Do you have a pointer to the documentation on this feature? Thinking about it again I'm not sure that I fully understand what you were suggesting -- are you suggesting adding a CNAME for x.example.com that redirects to yyyy.different-provider.com, and letting let's encrypt follow and work it out? I also wanted to know how everyone was trusting with their DNS requirements/how people were making the decision (cost, trust, privacy, country of origin, whatever else).
  - zAy0LfpBZLC8mAC 8y ago
    _acme-challenge.yourdomain.example CNAME whatever.name.your.txt.record.lives.at.invalid Probably the easiest way forward if you have any infrastructure yourself is to simply delegate some subzone of one of your domains to a nameserver you run yourself (like, delegate letsencrypt.yourdomain.example to your own nameserver), then point your CNAME to a name beneath that, and configure that nameserver for dynamic updates so your LE client can change the TXT record(s) on that server as needed.
    - kilburn 8y ago
      Have you tried it? According my reading of the challenge specification [1] it shouldn't work. Notice that it says: > 2. Query for TXT records for the validation domain name Verify that the contents of one of the TXT records match the digest value To me, this means that it should issue a query for TXT records only (not for ANY) and hence the server shouldn't even see your CNAME "redirector" record. Thus, if your method works, either the server is wrongly implemented, there's a flaw in my reading comprehension, or the specification should be amended... [1] https://ietf-wg-acme.github.io/acme/draft-ietf-acme-acme.html#rfc.section.8.4 https://ietf-wg-acme.github.io/acme/draft-ietf-acme-acme.htm...
luastoned 8y ago
I've had no issues with wildcard certs and Cloudflare as my DNS provider.
- auslander 8y ago
  You're OK giving your browsing history to Cloudflare?
  - aclave1 8y ago
    I think he meant that his site is using cloudflare as its dns provider, not his personal computer.
  - JshWright 8y ago
    The parent comment is reffering to the fact that they use CloudFlare to host DNS for the domains they control. That has nothing to do with the DNS resolvers their computers use (CloudFlare is certainly a reasonable choice there though... unless you don't use DNS at all, you have to trust someone)
    - auslander 8y ago
      Ok. But if they use Cloudflare, which MITMs traffic, all their users data is in plaintext to Cloudflare. Which leaks not only history, but also logins/passwords of site users. My beef with CF is that I can not see which sites are behind CF.
      - Operyl 8y ago
        Cloudflare has very specifically owned IPs and a number of tell tales to show that a site is behind it. Why do you have beef when it's practically dead simple to see that a site is protected by cloudflare. There's zero obfuscation.
        auslander 8y ago
        Please, how exactly in browser I can see it?
TomK32 8y ago
yeah, I bought a secondary domain for my budgeting project on Saturday and as soon as I had the dns configured I ran certbot on the server. something like 30 minutes from finding a good domain name to having ssl set up.
newman314 8y ago
Haven't tried with the wildcard certs yet but I've been using lego + Cloudflare as the DNS challenge provider with no issue. Works very nicely and it's scripted to automatically renew every 60 days. Now, it would be great if Cloudflare supported LE integration at it's free tier (replacing the Cloudflare wildcard cert).
scardine 8y ago
I use digitalocean, but also have a few wildcard manually verified with the --manual flag and a bit of cut & paste. It is 5 minutes every 3 months but it is free so I haven't bothered to automate it (just get an intern doing it every couple months). Lame, I know.
h1d 8y ago
Wildcard certs suddenly make auto renewing a challenge. For now, I just manually do it by updating DNS when monit tells me certs are getting old.
karlgrz 8y ago
I use digitalocean's DNS and had no problems getting wildcard certs. It's a bit annoying to wait for the updated records to resolve but other than that I had no issues.

DrPhish 8y ago

For wildcard certs, I run my own DNS infrastructure, so I just created the _acme-challenge records as indicated by the first run of certbot Are you unable to add arbitrary TXT records with your provider?

hardwaresofton 8y ago
I am, but I'm trying not to do it manually -- I actually use cert-manager[0] on a tiny kubernetes cluster -- which means when I make an Ingress for an application (app.example.com) (which does what it sounds like), watcher processes kick off and go get a cert for me with http 01 validation currently. This works thanks to cert-manager being able to automate the process of setting up the proper /.well-known/xxx route with access to kubernetes features. cert-manager also supports DNS 01, but of course they support the bigger providers (so they'll take some options and do the web requests to set up the TXT records)... I haven't looked into it a crazy amount (since in the end I can still just make multiple http 01 validated certs), but was just curious. [0]: https://github.com/jetstack/cert-manager/ https://github.com/jetstack/cert-manager/
- MertsA 8y ago
  FWIW Personally I just use the DNS RFC2136 plugin for certbot. I use bind for DNS.
  - hardwaresofton 8y ago
    Could you expand on this? You run bind on your server, then you add your own server as an (additional?) nameserver to your domain's registrar?

kragniz 8y ago

You can also set up a CNAME record to delegate the challenges to a provider with a supported API.

hardwaresofton 8y ago
Thanks for the tip -- that sounds like a great way forward. I can't find any documentation on it however after checking the community page (https://community.letsencrypt.org/t/acme-v2-production-environment-wildcards/55578 https://community.letsencrypt.org/t/acme-v2-production-envir...)... Do you have a pointer to the documentation on this feature? Thinking about it again I'm not sure that I fully understand what you were suggesting -- are you suggesting adding a CNAME for x.example.com that redirects to yyyy.different-provider.com, and letting let's encrypt follow and work it out? I also wanted to know how everyone was trusting with their DNS requirements/how people were making the decision (cost, trust, privacy, country of origin, whatever else).
- zAy0LfpBZLC8mAC 8y ago
  _acme-challenge.yourdomain.example CNAME whatever.name.your.txt.record.lives.at.invalid Probably the easiest way forward if you have any infrastructure yourself is to simply delegate some subzone of one of your domains to a nameserver you run yourself (like, delegate letsencrypt.yourdomain.example to your own nameserver), then point your CNAME to a name beneath that, and configure that nameserver for dynamic updates so your LE client can change the TXT record(s) on that server as needed.
  - kilburn 8y ago
    Have you tried it? According my reading of the challenge specification [1] it shouldn't work. Notice that it says: > 2. Query for TXT records for the validation domain name Verify that the contents of one of the TXT records match the digest value To me, this means that it should issue a query for TXT records only (not for ANY) and hence the server shouldn't even see your CNAME "redirector" record. Thus, if your method works, either the server is wrongly implemented, there's a flaw in my reading comprehension, or the specification should be amended... [1] https://ietf-wg-acme.github.io/acme/draft-ietf-acme-acme.html#rfc.section.8.4 https://ietf-wg-acme.github.io/acme/draft-ietf-acme-acme.htm...

luastoned 8y ago

I've had no issues with wildcard certs and Cloudflare as my DNS provider.

auslander 8y ago
You're OK giving your browsing history to Cloudflare?
- aclave1 8y ago
  I think he meant that his site is using cloudflare as its dns provider, not his personal computer.
- JshWright 8y ago
  The parent comment is reffering to the fact that they use CloudFlare to host DNS for the domains they control. That has nothing to do with the DNS resolvers their computers use (CloudFlare is certainly a reasonable choice there though... unless you don't use DNS at all, you have to trust someone)
  - auslander 8y ago
    Ok. But if they use Cloudflare, which MITMs traffic, all their users data is in plaintext to Cloudflare. Which leaks not only history, but also logins/passwords of site users. My beef with CF is that I can not see which sites are behind CF.
    - Operyl 8y ago
      Cloudflare has very specifically owned IPs and a number of tell tales to show that a site is behind it. Why do you have beef when it's practically dead simple to see that a site is protected by cloudflare. There's zero obfuscation.
      - auslander 8y ago
        Please, how exactly in browser I can see it?

TomK32 8y ago

yeah, I bought a secondary domain for my budgeting project on Saturday and as soon as I had the dns configured I ran certbot on the server. something like 30 minutes from finding a good domain name to having ssl set up.

newman314 8y ago

Haven't tried with the wildcard certs yet but I've been using lego + Cloudflare as the DNS challenge provider with no issue. Works very nicely and it's scripted to automatically renew every 60 days. Now, it would be great if Cloudflare supported LE integration at it's free tier (replacing the Cloudflare wildcard cert).

scardine 8y ago

I use digitalocean, but also have a few wildcard manually verified with the --manual flag and a bit of cut & paste. It is 5 minutes every 3 months but it is free so I haven't bothered to automate it (just get an intern doing it every couple months). Lame, I know.

h1d 8y ago

Wildcard certs suddenly make auto renewing a challenge. For now, I just manually do it by updating DNS when monit tells me certs are getting old.

karlgrz 8y ago

I use digitalocean's DNS and had no problems getting wildcard certs. It's a bit annoying to wait for the updated records to resolve but other than that I had no issues.