7 ms·

If someone finds LetsEncrypt challenging, they don't have sufficient network andsystem administrator skills to be running a private, public-facing web server. T

If someone finds LetsEncrypt challenging, they don't have sufficient network andsystem administrator skills to be running a private, public-facing web server. They should be running tailscale.

janwillemb 2y ago
Parent did not say it was challenging. I find fiddling with LE tedious because it has to be repeated too often.
- slt2021 2y ago
  certbot and crontab needs to be setup just once, to solve cert problem
  - deleted 2y ago
    [deleted]
  - Dalewyn 2y ago
    HTTPS when used in the ubiquitous manner it is now always strikes me as unnecessary complexity and tedium, and reasonings like yours addressing them with even more complexity and tedium. Whatever happened to KISS?
    - darkwater 2y ago
      It happened that the last S changed from "stupid" to "secure". If I use HTTPS I can safely enough connect to my home services through an open cafe Wifi, for example
- wibblewobble125 2y ago
  I’ve been using caddy for a year which does everything for you. Basically nginx/haproxy but with https built-in via LE, no fiddling about with cert files and brittle LE scripts, also supports subdomains equally easily.
vladvasiliu 2y ago
Well, one of the "challenges" is the one in a different comment: most registrars don't allow fine-grained control over who can update what DNS records. Can it be done? Sure. But do I want to spend money on this for my home lab if I can work around it? Not a chance. I'm kinda sensitive to the "MITM as a service" argument, but for my use case, it's not a problem.
- skinner927 2y ago
  You don’t need automated DNS fiddling for lets encrypt. Certbot can either hook into Apache or NGINX, or run its own standalone server for verification.
  - jsheard 2y ago
    You do need DNS fiddling if you want a wildcard cert, LE only accepts DNS challenges for those.
  - gunapologist99 2y ago
    Aside from sibling comment, you also need automated DNS fiddling if you want CloudFlare Strict TLS support, because if LE can only connect to CF proxy, it will never issue via HTTPS.
    - jsheard 2y ago
      You don't necessarily need to do that, Cloudflare can generate you a long-lived certificate to install on your origin server which isn't publicly trusted but is trusted by their proxies, so it works with Strict TLS. YMMV with other CDNs though, you might need to fall back to using LE with a DNS challenge in some cases. https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/ https://developers.cloudflare.com/ssl/origin-configuration/o...
    - Arrowmaster 2y ago
      Not true. I have a CF rule that matches . well-known/acme-challenge and sets SSL off. The main setting is on full strict but the rule disables the auto redirect to https and the strict checking so an acme client behind a CF tunnel can bootstrap a cert with the HTTP-01 method.
jgalt212 2y ago
so public server via http only then?

If someone finds LetsEncrypt challenging, they don't have sufficient network andsystem administrator skills to be running a private, public-facing web server. They should be running tailscale.

janwillemb 2y ago

Parent did not say it was challenging. I find fiddling with LE tedious because it has to be repeated too often.

slt2021 2y ago
certbot and crontab needs to be setup just once, to solve cert problem
- deleted 2y ago
  [deleted]
- Dalewyn 2y ago
  HTTPS when used in the ubiquitous manner it is now always strikes me as unnecessary complexity and tedium, and reasonings like yours addressing them with even more complexity and tedium. Whatever happened to KISS?
  - darkwater 2y ago
    It happened that the last S changed from "stupid" to "secure". If I use HTTPS I can safely enough connect to my home services through an open cafe Wifi, for example
wibblewobble125 2y ago
I’ve been using caddy for a year which does everything for you. Basically nginx/haproxy but with https built-in via LE, no fiddling about with cert files and brittle LE scripts, also supports subdomains equally easily.

vladvasiliu 2y ago

Well, one of the "challenges" is the one in a different comment: most registrars don't allow fine-grained control over who can update what DNS records. Can it be done? Sure. But do I want to spend money on this for my home lab if I can work around it? Not a chance. I'm kinda sensitive to the "MITM as a service" argument, but for my use case, it's not a problem.

skinner927 2y ago
You don’t need automated DNS fiddling for lets encrypt. Certbot can either hook into Apache or NGINX, or run its own standalone server for verification.
- jsheard 2y ago
  You do need DNS fiddling if you want a wildcard cert, LE only accepts DNS challenges for those.
- gunapologist99 2y ago
  Aside from sibling comment, you also need automated DNS fiddling if you want CloudFlare Strict TLS support, because if LE can only connect to CF proxy, it will never issue via HTTPS.
  - jsheard 2y ago
    You don't necessarily need to do that, Cloudflare can generate you a long-lived certificate to install on your origin server which isn't publicly trusted but is trusted by their proxies, so it works with Strict TLS. YMMV with other CDNs though, you might need to fall back to using LE with a DNS challenge in some cases. https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/ https://developers.cloudflare.com/ssl/origin-configuration/o...
  - Arrowmaster 2y ago
    Not true. I have a CF rule that matches . well-known/acme-challenge and sets SSL off. The main setting is on full strict but the rule disables the auto redirect to https and the strict checking so an acme client behind a CF tunnel can bootstrap a cert with the HTTP-01 method.

jgalt212 2y ago

so public server via http only then?