3 ms·
Currently, Caddy will automatically fail over to ZeroSSL if it can't get a cert from Let's Encrypt. (You can even configure other sources in addition to, or ins
by mholt 5y ago
Currently, Caddy will automatically fail over to ZeroSSL if it can't get a cert from Let's Encrypt. (You can even configure other sources in addition to, or instead of, LE and ZeroSSL. For example, you could have it fall back to a self-signed cert as a last resort.)
There's really no good reason for a site to go down due to PKI. Caddy has proven this.
- Arnavion 5y agoDoes it handle updating the domain's CAA record? Or do you have to not use CAA records when using this feature?
- coder543 5y agoYou can have multiple CAA records for a domain. Given how slow DNS propagation is, rapidfire rewriting of CAA records as you failover to a different CA seems like a recipe for causing errors... which is the last thing you want as you're failing over. I did a quick google search, and nothing indicated that Caddy will manage CAA records for you, which sounds very sensible to me.
- Arnavion 5y agoHaving multiple CAA records seems to me to kind of defeat the purpose of having a CAA record in the first place. But I guess if you limit it to two or three it'd still be fine.
- majewsky 5y agoThe purpose of CAA records is mostly to exclude CAs you don't trust. It's less of a "I trust Let's Encrypt" and more of a "I don't trust Honest Achmed". (Context for "Honest Achmed": https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959)
- mholt 5y agoThis can be automated with DNS provider modules, if someone would like to implement it: https://github.com/caddy-dns https://github.com/caddy-dns