4 ms·
I'm using all three, Apache, Caddy and nginx almost daily. For the trivial, Caddy is amazing. When things get more complex alongside needs themselves, nginx is
by Avamander 4y ago
I'm using all three, Apache, Caddy and nginx almost daily. For the trivial, Caddy is amazing. When things get more complex alongside needs themselves, nginx is amazingly powerful. Apache at the same point becomes overly verbose, anomalous and painful. It does take some discipline though, to comment and structure your configuration files, but that applies to anything that isn't trivial. return 444; alone is a great feature I can't do without, not to mention all the modules one can use.
The thing with certificates is that most tutorials are terrible. A very seamless way is to use the webroot method. Create a nginx configuration file that places LE's challenges to a specified folder on your system, include that config into your server blocks. Then you instruct certbot to use that folder. Really quite easy.
- TheRealDunkirk 4y ago> Really quite easy. “Your ideas are intriguing to me, and I wish to subscribe to your newsletter.” Is there a detailed writeup on this? This sounds great, but I don't want to faff about with it.
- Avamander 4y agoIn its most simple form, it works as follows. /etc/nginx/letsencrypt.conf: location /.well-known/acme-challenge { default_type "text/plain"; try_files $uri $uri/ =404; root /tmp/letsencrypt-auto; } /etc/nginx/sites-enabled/default: server { [...] include letsencrypt.conf; [...] } Reload nginx. Invoke certbot for the new domain once with: certbot certonly --webroot -w /tmp/letsencrypt-auto/ [--must-staple] -d example.com
- braiam 4y agoWait, how does that makes nginx use the certificates? For me it doesn't have any cerbot/letsencrytpt specific configuration as I use DNS-01. I just point ssl_certificate and ssl_certificate_key to the correct path where cerbot saves the certificates and be done with it.
- Avamander 4y agoMaking use is easy as well, like you described. Just a matter of specifying ssl_certificate(_key) path. It doesn't support variables so it can't be based on the server block's domain/variables unfortunately. DNS challenges are a bit more seamless, but I personally don't like giving access to entire zones to a single machine. Like most DNS APIs force you to.
- jefurii 4y agoThe LetsEncrypt tutorial showed me exactly this configuration.
- mholt 4y agoWhat's keeping you from using Caddy exclusively?
- everybodyknows 4y agoFor us non-specialists, is 444 a shorthand "terminate with extreme prejudice" upon suspected hacking? https://serverfault.com/questions/822484/nginx-444-error-eqivalent-in-apache https://serverfault.com/questions/822484/nginx-444-error-eqi...
- Avamander 4y agoIt's great if you want to not even bother replying to some requests. I like to use it to not reply to requests that come without a valid SNI/Host.