6 ms·

Then use a different method of validation, like DNS?

josteink 7y ago
DNS validation once setup is so much easier to work with, for all use-cases I can imagine, I will never go back to HTTP-based authentication. Really, do give it a try.
Avamander 7y ago
Impossible (to do safely) with most providers I've seen, even CloudFlare doesn't offer a properly limited API key.
- RL_Quine 7y ago
  So delegate the validation with a CNAME and do it somewhere that’s not cloudflare. They provide signing with their own CA for origin certificates so I don’t really know why you’re using Let’s Encrypt at all. Your idea of just randomly blocking access from certain IP address ranges doesn’t really provide you with any security at all. If you’re worried about rusaian hackers or whatever, most people exploiting anything have access to botnets with whatever bespoke IP address ranges they need to bypass those sort of rules. In anti fraud we see this commonly, people using stolen details will happily get better matches with GEOIP than the legitimate users of the credentials. Blocking specific countries IP allocations is just providing a false sense security on your part.
  - Avamander 7y ago
    > So delegate the validation with a CNAME and do it somewhere that’s not cloudflare. Like? For what price? > Blocking specific countries IP allocations is just providing a false sense security on your part. No, it's a preventative measure. Just like changing SSH to a non-standard port reduces pointless attempts.
    - throw0101a 7y ago
      > Like? For what price? If you own example.com, you can delegate to dnsauth.example.com for $0 (or simply the price of a Internet-facing machine that has DNS open). Say you want a cert for www.example.com. LE will check for ownership by looking up _acme-challenge.www.example.com. Instead of having a TXT record with the nonce, _acme-challenge.www is actually a CNAME pointing to _acme-challenge.www.dnsauth--where the TXT nonce lives. The DNS daemon that is authoritative for dnsauth can be the traditional BIND, or other software: * https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns This is often called 'DNS alias' mode: * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mode https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...
      - Avamander 7y ago
        I did not ask "how", I wished to know who supports a DNS service like that and for what price.
        GuyPostington 7y ago
        The parent stated that you can run your own DNS server temporarily for the cost of the hardware to run the server and shut the DNS server off after the certificate has been issued. The cost is basically free.
        jlgaddis 7y ago
        Any DNS service which allows you to create a CNAME RR supports it. You delegate the subdomain to any DNS server you wish. This isn't some special "Let's Encrypt DNS forwarding mode" that DNS providers have to explicitly support. It's simply part of "how DNS works".
        Avamander 7y ago
        > Any DNS service which allows you to create a CNAME RR supports it. And which of those also have an API that is supported by Certbot? I would really like names where a setup like this has been tested and works.
  - TrueDuality 7y ago
    Even with CloudFlare in front of your servers, it is still valuable to use Let's Encrypt certificates. You can turn on Full Strict SSL validation to the backend and reduce another attack vector. It's an unlikely attack vector to be exploited but it's also a trivial amount of work to implement. Every layer of security makes attacks that much more costly.
    - RL_Quine 7y ago
      Like I said cloudflare signs certificates for your origin as well.
      - tialaramex 7y ago
        And if you always use Cloudflare (or at least are sure you'd have days-weeks not minutes-hours between making a decision to cease using Cloudflare and actually executing) then it's actually safer to tell them you'll use their Origin certs rather than a public CA as well as likely being easier.
- aianus 7y ago
  Why can't you do this safely with AWS? You can restrict the API key to write only to the zone _acme-challenge.<your domain>.
  - vegardx 7y ago
    Smart way to do it, but it will set you back $0.5/month. You can likely do it cheaper with Lambda and API Gateway, but you'll have to invent the secret sauce yourself. I'm always a little surprised when there are short comings in IAM like that with route53 and records. It seems like a natural thing to be able to control, but for some reason you don't have resource level controls on hosted zones. It's all or nothing.
- stilldavid 7y ago
  This is now supported as of a few weeks ago! I just set it up for a new domain using a cancel-able API key.
  - watermelon0 7y ago
    I've just checked it, but with API tokens, I can only allow 'edit' rights on DNS records for a specific domain. There is no way to create a token allowing access only to _acme-challenge record.
    - tialaramex 7y ago
      You can use the CNAME trick to canonicalize all ACME challenge requests into a subdomain you reserved for this purpose and then give the tokens access to that subdomain. Let's Encrypt is obeying normal DNS mechanics, so when they ask for a TXT record for _acme-challenge.cat-photos.example.com and get a CNAME as a response, they'll ask for the TXT record for the name in the CNAME answer instead. If that's cat-photos.cert-issuer.example.com then a token valid only for the sub-domain cert-issuer.example.com can write that TXT record. You sort out the CNAME once, probably when creating cat-photos.example.com or setting it up to get a certificate, and then afterwards the API token is enough for automation.
- belorn 7y ago
  If you have that kind of security profile that you need to lock down what ip addresses that can make a port 80 connection, and can't use the api of the dns provider because of security considerations, then how is giving a third party dns provider full control of DNS acceptable within the threat model? Run your own DNS server and get a registrar lock. If that is not feasible, and consultants are too expensive, I would look into the more expensive dns providers that provide custom interface that fit the threat model of your system. If that is also too expensive then I would take a second look at the risk analysis and recalculate the cost of each risk.

DNS validation once setup is so much easier to work with, for all use-cases I can imagine, I will never go back to HTTP-based authentication. Really, do give it a try.

Avamander 7y ago

Impossible (to do safely) with most providers I've seen, even CloudFlare doesn't offer a properly limited API key.

RL_Quine 7y ago
So delegate the validation with a CNAME and do it somewhere that’s not cloudflare. They provide signing with their own CA for origin certificates so I don’t really know why you’re using Let’s Encrypt at all. Your idea of just randomly blocking access from certain IP address ranges doesn’t really provide you with any security at all. If you’re worried about rusaian hackers or whatever, most people exploiting anything have access to botnets with whatever bespoke IP address ranges they need to bypass those sort of rules. In anti fraud we see this commonly, people using stolen details will happily get better matches with GEOIP than the legitimate users of the credentials. Blocking specific countries IP allocations is just providing a false sense security on your part.
- Avamander 7y ago
  > So delegate the validation with a CNAME and do it somewhere that’s not cloudflare. Like? For what price? > Blocking specific countries IP allocations is just providing a false sense security on your part. No, it's a preventative measure. Just like changing SSH to a non-standard port reduces pointless attempts.
  - throw0101a 7y ago
    > Like? For what price? If you own example.com, you can delegate to dnsauth.example.com for $0 (or simply the price of a Internet-facing machine that has DNS open). Say you want a cert for www.example.com. LE will check for ownership by looking up _acme-challenge.www.example.com. Instead of having a TXT record with the nonce, _acme-challenge.www is actually a CNAME pointing to _acme-challenge.www.dnsauth--where the TXT nonce lives. The DNS daemon that is authoritative for dnsauth can be the traditional BIND, or other software: * https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns This is often called 'DNS alias' mode: * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mode https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...
    - Avamander 7y ago
      I did not ask "how", I wished to know who supports a DNS service like that and for what price.
      - GuyPostington 7y ago
        The parent stated that you can run your own DNS server temporarily for the cost of the hardware to run the server and shut the DNS server off after the certificate has been issued. The cost is basically free.
      - jlgaddis 7y ago
        Any DNS service which allows you to create a CNAME RR supports it. You delegate the subdomain to any DNS server you wish. This isn't some special "Let's Encrypt DNS forwarding mode" that DNS providers have to explicitly support. It's simply part of "how DNS works".
        Avamander 7y ago
        > Any DNS service which allows you to create a CNAME RR supports it. And which of those also have an API that is supported by Certbot? I would really like names where a setup like this has been tested and works.
- TrueDuality 7y ago
  Even with CloudFlare in front of your servers, it is still valuable to use Let's Encrypt certificates. You can turn on Full Strict SSL validation to the backend and reduce another attack vector. It's an unlikely attack vector to be exploited but it's also a trivial amount of work to implement. Every layer of security makes attacks that much more costly.
  - RL_Quine 7y ago
    Like I said cloudflare signs certificates for your origin as well.
    - tialaramex 7y ago
      And if you always use Cloudflare (or at least are sure you'd have days-weeks not minutes-hours between making a decision to cease using Cloudflare and actually executing) then it's actually safer to tell them you'll use their Origin certs rather than a public CA as well as likely being easier.
aianus 7y ago
Why can't you do this safely with AWS? You can restrict the API key to write only to the zone _acme-challenge.<your domain>.
- vegardx 7y ago
  Smart way to do it, but it will set you back $0.5/month. You can likely do it cheaper with Lambda and API Gateway, but you'll have to invent the secret sauce yourself. I'm always a little surprised when there are short comings in IAM like that with route53 and records. It seems like a natural thing to be able to control, but for some reason you don't have resource level controls on hosted zones. It's all or nothing.
stilldavid 7y ago
This is now supported as of a few weeks ago! I just set it up for a new domain using a cancel-able API key.
- watermelon0 7y ago
  I've just checked it, but with API tokens, I can only allow 'edit' rights on DNS records for a specific domain. There is no way to create a token allowing access only to _acme-challenge record.
  - tialaramex 7y ago
    You can use the CNAME trick to canonicalize all ACME challenge requests into a subdomain you reserved for this purpose and then give the tokens access to that subdomain. Let's Encrypt is obeying normal DNS mechanics, so when they ask for a TXT record for _acme-challenge.cat-photos.example.com and get a CNAME as a response, they'll ask for the TXT record for the name in the CNAME answer instead. If that's cat-photos.cert-issuer.example.com then a token valid only for the sub-domain cert-issuer.example.com can write that TXT record. You sort out the CNAME once, probably when creating cat-photos.example.com or setting it up to get a certificate, and then afterwards the API token is enough for automation.
belorn 7y ago
If you have that kind of security profile that you need to lock down what ip addresses that can make a port 80 connection, and can't use the api of the dns provider because of security considerations, then how is giving a third party dns provider full control of DNS acceptable within the threat model? Run your own DNS server and get a registrar lock. If that is not feasible, and consultants are too expensive, I would look into the more expensive dns providers that provide custom interface that fit the threat model of your system. If that is also too expensive then I would take a second look at the risk analysis and recalculate the cost of each risk.