3 ms·
>In order to avoid this issue, ACME requires your web server to communicate with an external service provider to sign the certificate. But now you're dependent
by Saris 5y ago
>In order to avoid this issue, ACME requires your web server to communicate with an external service provider to sign the certificate. But now you're dependent on Lets Encrypt being able to access your server!
Only if you're using the HTTP challenge, the DNS challenge is (IMO at least) much simpler, easier, doesn't require any services open to the internet so can work in a LAN, and can issue wildcard certs too.
If you use a webserver like Caddy as well, then your SSL certs are done automatically without you needing to do much of anything at all.
- gravypod 5y agoSuper agree with this comment. Been using Caddy with DNS and it's been amazing.
- squiggleblaz 5y agoThat's true, and instead of verifying that Lets Encrypt can contact your server, they verify that you can control the DNS. It isn't compatible with least privilege though, is it? Either every box that wants to use SSL has to be capable of changing DNS settings, or you need a central box that generates secrets and securely transmits them to the servers. I have domain names which I am authorised to serve content on, but not authorised to manipulate DNS for (but they're all exposed to the internet, so not relevant to the limitation - but probably the reason I overlooked the blindingly obvious solution)