4 ms·
Or, it's super easy to roll your own using letsencrypt. 1. Buy your own public domain (such as companyname.dev) 2. Setup a LetsEncrypt wildcard certificate wi
by Humphrey 3y ago
Or, it's super easy to roll your own using letsencrypt.
1. Buy your own public domain (such as companyname.dev)
2. Setup a LetsEncrypt wildcard certificate with DNS validation
3. Update your /etc/hosts to something like `127.0.0.1 companyname.dev`
We have this working with multiple developers, each renewing their certificates themselves. Works great, it's simple, and don't need to trust an extra third party.
- klysm 3y agoJust at the whole domain or does each dev make their own subdomain?
- Humphrey 3y agoWe setup each project with it's own subdomain... so a /etc/hosts file would be something like 127.0.0.1 client7.companyname.dev our-amazing-product.companyname.dev postgres2.companyname.dev So, then we can use the same settings, etc across devs. Then each dev just runs the script to renew the script as they are needed (no need to share certs between devs)
- 8organicbits 3y agoCorrect, a distinction with this service is that the domain names are free. One part of my decision to build this service was the fall of freenom (free domain names). Typically free domain name services are full of spam, malware, and other junk. getlocalcert seeks to avoid that as it only permits private network usage. My hope is that this model can serve that niche while avoiding abuse.
- Humphrey 3y agoYeah nice! Good to know
- ushakov 3y agoHow will you make money?
- 8organicbits 3y agoI'm potentially using this as a portfolio piece for my freelance consulting work [1]. Many clients require NDAs, so it can be tough to talk about specific, recent accomplishments. Operational costs are low: around $40/year in domains and $20/month in servers. Soliciting donations could probably cover that (some similar free services work that way). [1] https://www.robalexdev.com/ https://www.robalexdev.com/
- ushakov 3y agoWith your work history, you probably don't need any portfolio projects ;)
- esbeeb 3y agoLast time I checked, those wildcard LetsEncrypt certs take more work to get, like passing a DNS-based TXT record challenge. Then once you have the wildcard certs, they only last 3 months. Once obtained, they can manually be copied into the LAN using a tool like wormhole. There's a lot of manual steps here which are far harder than how certbot will auto-renew certs when in the cloud - usually requiring no manual intervention, once you succeed that first time.
- deleted 3y ago[deleted]
- 8organicbits 3y agoOne of my inspirations for getlocalcert is a tool to make DNS-01 easier. acme-dns let's you add a CNAME to another DNS zone, which let's you issue certificates for the former domain name using a convenient API for the latter zone. Seriously read about it, it's awesome. https://github.com/joohoi/acme-dns/ https://github.com/joohoi/acme-dns/ That tool is open source and self-hostable. getlocalcert also provides this feature, but as a hosted service. Choose the method you prefer. https://docs.getlocalcert.net/tips/validation-domain/ https://docs.getlocalcert.net/tips/validation-domain/ Once DNS-01 is easy, wildcard certs are easy. Here's the docs for setting up a wildcard cert via getlocalcert: https://docs.getlocalcert.net/acme-clients/lego/ https://docs.getlocalcert.net/acme-clients/lego/
- esbeeb 3y agoThanks for the explanations! Great links.
- bruce511 3y agoAll the steps are automatable though. I know cause I built it into my own server engine. This service looks like the same thing. I guess if you're limited to certain then you can only do what it does, but I'm guessing there's lots of alternative software that'll do the DNS challenge if you look.
- Humphrey 3y ago> Once obtained, they can manually be copied into the LAN using a tool like wormhole. We haven't needed to copy the certs around the LAN. It works fine with dev's just individually running certbot renew as needed. Yes, it tooks us a fair bit of fiddling around to work out how to do it, but final result is super simple. So I definitely would have considered a project like this in the past, but now we've got the scripts for it, it's pretty simple.
- AndyMcConachie 3y agoThe big difference I can see is that getlocalcert.net does not require the user to run a DNS server.