3 ms·
Before I used DNS verification, Apache had to be down for a minute so certbot could offer the appropriate URLs itself for the 20-something domains/subdomains I
by necovek 5y ago
Before I used DNS verification, Apache had to be down for a minute so certbot could offer the appropriate URLs itself for the 20-something domains/subdomains I have a cert issued for. Maybe there's a parallelize option I missed?
I am sure there is an Apache module to short-circuit this (i.e. offer whatever verification tokens are needed on top of whatever Apache is serving otherwise), but I personally did not bother.
> And again, this is assuming you start from the premise that you must host your own thing and manage your own thing;
Sure, but that's what the premise is. "Must" is a strong word, but I'd go with "want".
And one can satisfy the "want" without the unnecessary work like HTTPS certs. No matter how minute, they are significant compared to the maintenance burden otherwise.
All I am saying is that it's a perfectly valid position OP has, and that there is more work and maintenance needed even for "automated" LetsEncrypt certs.
- detaro 5y agoRe the first point: The verification is specifically designed so it just involves fetching files and thus can be done through a folder served by the main webserver. Certbot writes the challenge responses in that folder, informs LE that is has done so, the verification fetches them, your Apache serves them. Years ago when I first setup LE I think one needed to configure some of that manually for nginx (or maybe I just didn't trust it and decided to ignore the automatic setup? not sure).
- necovek 5y agoAll the arguments against this being extra work are pointing how it's possible to do it (extra work, ain't it?). In a nutshell, I agree and it's worth it to _me_. It is still extra work :) FWIW, my Apache is a reverse proxy to multiple VMs for each different service I run, so without pulling out my mod_rewrite skills out, "just serving a folder certbot can write to" is anything but.