8 ms·

Here is a maintained list of all known, public ACME endpoints: https://docs.https.dev/list-of-acme-servers https://docs.https.dev/list-of-acme-servers In Caddy

by mholt 6y ago

Here is a maintained list of all known, public ACME endpoints: https://docs.https.dev/list-of-acme-servers https://docs.https.dev/list-of-acme-servers In Caddy 2.3, Caddy [1] will default to both Let's Encrypt and ZeroSSL [2]. If it can't get a cert from one, it will try the other. You can configure more too, including self-signed certs, as a last fallback for example. Caddy will be the first web server and ACME client to support multi-issuer fallback. (Pre-releases coming soon, or you can build from source and try it today.) ZeroSSL's website is being updated to clarify that certs are free and unlimited through ACME. You can even view them in your ZeroSSL dashboard. [1]: https://caddyserver.com https://caddyserver.com [2]: https://github.com/caddyserver/caddy/pull/3862 https://github.com/caddyserver/caddy/pull/3862

bxk1 6y ago
For anyone else wondering why they use ZeroSSL as a fallback: "Caddy has been acquired by the company behind ZeroSSL"
- mholt 6y ago
  True, that's one reason, but I've been planning this feature for years and would have implemented it either way. As explained in the linked pull request: - Let's Encrypt is a busy non-profit organization. We can help maximize their budget by not using it as the exclusive default for every server. - ZeroSSL does not have rate limits and is also publicly trusted. And yes, it is free to use it with ACME. - ZeroSSL offers a graphical dashboard where you can log in and see and download your certificates. - Having more than just 1 free ACME CA is a very, very good thing for the PKI ecosystem. This is the beauty of standardization; if you give a server a URL, you can give it two and three and four, and not have to worry about global reliance on a single source.
  - HeroSSL 6y ago
    Please have or be or create my babies. Dang be fucked, I bypassed the commenting cocksuckery! Lucky for me.
  - ryan29 6y ago
    There's also a lot of opportunity for CAs to get better IMO, so competition is useful. I'd hate to see a commercial company displace LE, but there are so many value adds that can be sold once you're the CA of choice that it seems inevitable that a commercial CA with a LE style free tier is going to have a lot of opportunity. IMO the biggest, easiest feature no CA has implemented is CTLog monitoring / reconciliation. The problem I have with LE even on a small scale is that I'm grabbing certificates for ~20 (sub)domains. I also have several of them set up via Cloudflare. With CTLog monitoring notifications (via Cloudflare and Facebook), I get too many notifications. I don't know what's coming or going or which machines are requesting certificates for which (sub)domains. A service like ZeroSSL is already acting like a central point of certificate management (for me), so it's the ideal location to do CTLog monitoring since the bulk of certificate issuances happen there. That means legitimate CTLog entries can be reconciled and ignored silently (they'll already show up in the dashboard). I'm not sure how user accounts work in ACME, but the other thing I'd like is to be able to track which user or machine requested a certificate. I'm sure something like that could also be built as a proxy. I thought about trying once, but it's firmly in my "things I'll never get to" idea box. Lol. Another problem I've had with LE that could use a solution is a 3rd party service that I signed up for requesting certificates, but not installing them correctly and hitting the LE limits for that domain. If the mindshare changes from LE to ACME, maybe there'll be a day where 3rd parties will let me specify an ACME provider and link it to my main account somehow.
    - francislavoie 6y ago
      ACME has a concept of EAB (external account binding) credentials, basically like an API key. https://zerossl.com/documentation/acme/ https://zerossl.com/documentation/acme/ Caddy supports this, so what you want to do should be covered.
    - ThePowerOfFuet 6y ago
      Have you considered a wildcard cert?
  - znpy 6y ago
    > - ZeroSSL does not have rate limits and is also publicly trusted. And yes, it is free to use it with ACME. Hey, where on the site is that said? I'd like to consider that for work purposes, but I can't find the "we don't rate limit" writing anywhere.
    - mholt 6y ago
      https://zerossl.com/features/acme/ https://zerossl.com/features/acme/ > Unlimited & Zero Cost > In an effort to ensure the widest possible SSL certificate coverage around the world, our team has decided to keep all ZeroSSL certificates created using the ACME protocol completely free of charge.
      - znpy 6y ago
        Yep but that doesn't say that they won't rate limit, or what the rate limit is.
        mholt 6y ago
        So you can either use a CA that has rate limits, or one that does not. It's up to you.
linsomniac 6y ago
I've been using Caddy on some personal and community sites for around a year and it's worked out just great! The built in certificate management has been so nice compared to having to manage external letsencrypt tooling. More recently I set up a VM at work to be a domain redirector for a bunch of typo domains to our main domains, since the old outsourced redirectors didn't have TLS, and it was dead simple!
- mholt 6y ago
  Awesome, glad to hear it! Let me know if you have any suggestions for improvements.
  - kuschku 6y ago
    How about supporting absolute hostnames? Even this site (https://news.ycombinator.com./ https://news.ycombinator.com./) supports them just fine, only Caddy doesn’t. Caddy does it so badly that the HSTS preload for caddyserver.com is interpreted by browsers as applying to caddyserver.com. (which is correct), but caddy won't actually serve that spec-compliant website: https://caddyserver.com./ https://caddyserver.com./ (just throws an SSL error)
    - tialaramex 6y ago
      The specification explicitly says what you want is the Wrong Thing™. The designers of SNI didn't leave this vague, they spelled it out first in RFC 3546 and most recently in RFC 6066 https://tools.ietf.org/html/rfc6066#section-3 https://tools.ietf.org/html/rfc6066#section-3 > "HostName" contains the fully qualified DNS hostname of the server, as understood by the client. The hostname is represented as a byte string using ASCII encoding without a trailing dot. † So, when your web browser sends the hostname "news.ycombinator.com." that's not an "absolute hostname" that's just an error. Maybe you can demand that web browsers stop doing that, but they'll likely tell you they don't care, and you should stop writing URLs incorrectly. † The trailing dot rule was in every version, but earliest sources talked about using UTF8 because they pre-date the insight that all this backend (ie not human-facing) stuff can use A-labels which are ASCII and avoid any complicated Unicode problems. This version just says to use ASCII here.
miniyarov 6y ago
At ZudVPN (https://zudvpn.com https://zudvpn.com) we use Caddy to retrieve certificates for subdomain.zudvpn.com where they are later used for VPN connections instead of web server. This makes us be able to issue personal VPNs secured with SSL/TLS on any major Cloud Providers. I would thank both Caddy and Let's Encrypt that opens endless opportunities around secure connection.
dr_faustus 6y ago
Thank you so much for Caddy and open sourcing it completely. Every few years there comes a piece of software that really opens ones eyes how overcomplicated life was before. Caddy is absolutely one of those.

by mholt 6y ago

bxk1 6y ago

For anyone else wondering why they use ZeroSSL as a fallback: "Caddy has been acquired by the company behind ZeroSSL"

mholt 6y ago
True, that's one reason, but I've been planning this feature for years and would have implemented it either way. As explained in the linked pull request: - Let's Encrypt is a busy non-profit organization. We can help maximize their budget by not using it as the exclusive default for every server. - ZeroSSL does not have rate limits and is also publicly trusted. And yes, it is free to use it with ACME. - ZeroSSL offers a graphical dashboard where you can log in and see and download your certificates. - Having more than just 1 free ACME CA is a very, very good thing for the PKI ecosystem. This is the beauty of standardization; if you give a server a URL, you can give it two and three and four, and not have to worry about global reliance on a single source.
- HeroSSL 6y ago
  Please have or be or create my babies. Dang be fucked, I bypassed the commenting cocksuckery! Lucky for me.
- ryan29 6y ago
  There's also a lot of opportunity for CAs to get better IMO, so competition is useful. I'd hate to see a commercial company displace LE, but there are so many value adds that can be sold once you're the CA of choice that it seems inevitable that a commercial CA with a LE style free tier is going to have a lot of opportunity. IMO the biggest, easiest feature no CA has implemented is CTLog monitoring / reconciliation. The problem I have with LE even on a small scale is that I'm grabbing certificates for ~20 (sub)domains. I also have several of them set up via Cloudflare. With CTLog monitoring notifications (via Cloudflare and Facebook), I get too many notifications. I don't know what's coming or going or which machines are requesting certificates for which (sub)domains. A service like ZeroSSL is already acting like a central point of certificate management (for me), so it's the ideal location to do CTLog monitoring since the bulk of certificate issuances happen there. That means legitimate CTLog entries can be reconciled and ignored silently (they'll already show up in the dashboard). I'm not sure how user accounts work in ACME, but the other thing I'd like is to be able to track which user or machine requested a certificate. I'm sure something like that could also be built as a proxy. I thought about trying once, but it's firmly in my "things I'll never get to" idea box. Lol. Another problem I've had with LE that could use a solution is a 3rd party service that I signed up for requesting certificates, but not installing them correctly and hitting the LE limits for that domain. If the mindshare changes from LE to ACME, maybe there'll be a day where 3rd parties will let me specify an ACME provider and link it to my main account somehow.
  - francislavoie 6y ago
    ACME has a concept of EAB (external account binding) credentials, basically like an API key. https://zerossl.com/documentation/acme/ https://zerossl.com/documentation/acme/ Caddy supports this, so what you want to do should be covered.
  - ThePowerOfFuet 6y ago
    Have you considered a wildcard cert?
- znpy 6y ago
  > - ZeroSSL does not have rate limits and is also publicly trusted. And yes, it is free to use it with ACME. Hey, where on the site is that said? I'd like to consider that for work purposes, but I can't find the "we don't rate limit" writing anywhere.
  - mholt 6y ago
    https://zerossl.com/features/acme/ https://zerossl.com/features/acme/ > Unlimited & Zero Cost > In an effort to ensure the widest possible SSL certificate coverage around the world, our team has decided to keep all ZeroSSL certificates created using the ACME protocol completely free of charge.
    - znpy 6y ago
      Yep but that doesn't say that they won't rate limit, or what the rate limit is.
      - mholt 6y ago
        So you can either use a CA that has rate limits, or one that does not. It's up to you.

linsomniac 6y ago

I've been using Caddy on some personal and community sites for around a year and it's worked out just great! The built in certificate management has been so nice compared to having to manage external letsencrypt tooling. More recently I set up a VM at work to be a domain redirector for a bunch of typo domains to our main domains, since the old outsourced redirectors didn't have TLS, and it was dead simple!

mholt 6y ago
Awesome, glad to hear it! Let me know if you have any suggestions for improvements.
- kuschku 6y ago
  How about supporting absolute hostnames? Even this site (https://news.ycombinator.com./ https://news.ycombinator.com./) supports them just fine, only Caddy doesn’t. Caddy does it so badly that the HSTS preload for caddyserver.com is interpreted by browsers as applying to caddyserver.com. (which is correct), but caddy won't actually serve that spec-compliant website: https://caddyserver.com./ https://caddyserver.com./ (just throws an SSL error)
  - tialaramex 6y ago
    The specification explicitly says what you want is the Wrong Thing™. The designers of SNI didn't leave this vague, they spelled it out first in RFC 3546 and most recently in RFC 6066 https://tools.ietf.org/html/rfc6066#section-3 https://tools.ietf.org/html/rfc6066#section-3 > "HostName" contains the fully qualified DNS hostname of the server, as understood by the client. The hostname is represented as a byte string using ASCII encoding without a trailing dot. † So, when your web browser sends the hostname "news.ycombinator.com." that's not an "absolute hostname" that's just an error. Maybe you can demand that web browsers stop doing that, but they'll likely tell you they don't care, and you should stop writing URLs incorrectly. † The trailing dot rule was in every version, but earliest sources talked about using UTF8 because they pre-date the insight that all this backend (ie not human-facing) stuff can use A-labels which are ASCII and avoid any complicated Unicode problems. This version just says to use ASCII here.

miniyarov 6y ago

At ZudVPN (https://zudvpn.com https://zudvpn.com) we use Caddy to retrieve certificates for subdomain.zudvpn.com where they are later used for VPN connections instead of web server. This makes us be able to issue personal VPNs secured with SSL/TLS on any major Cloud Providers. I would thank both Caddy and Let's Encrypt that opens endless opportunities around secure connection.

dr_faustus 6y ago

Thank you so much for Caddy and open sourcing it completely. Every few years there comes a piece of software that really opens ones eyes how overcomplicated life was before. Caddy is absolutely one of those.