6 ms·

Well, one of the "challenges" is the one in a different comment: most registrars don't allow fine-grained control over who can update what DNS records. Can it

Well, one of the "challenges" is the one in a different comment: most registrars don't allow fine-grained control over who can update what DNS records. Can it be done? Sure. But do I want to spend money on this for my home lab if I can work around it? Not a chance. I'm kinda sensitive to the "MITM as a service" argument, but for my use case, it's not a problem.

skinner927 2y ago
You don’t need automated DNS fiddling for lets encrypt. Certbot can either hook into Apache or NGINX, or run its own standalone server for verification.
- jsheard 2y ago
  You do need DNS fiddling if you want a wildcard cert, LE only accepts DNS challenges for those.
- gunapologist99 2y ago
  Aside from sibling comment, you also need automated DNS fiddling if you want CloudFlare Strict TLS support, because if LE can only connect to CF proxy, it will never issue via HTTPS.
  - jsheard 2y ago
    You don't necessarily need to do that, Cloudflare can generate you a long-lived certificate to install on your origin server which isn't publicly trusted but is trusted by their proxies, so it works with Strict TLS. YMMV with other CDNs though, you might need to fall back to using LE with a DNS challenge in some cases. https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/ https://developers.cloudflare.com/ssl/origin-configuration/o...
  - Arrowmaster 2y ago
    Not true. I have a CF rule that matches . well-known/acme-challenge and sets SSL off. The main setting is on full strict but the rule disables the auto redirect to https and the strict checking so an acme client behind a CF tunnel can bootstrap a cert with the HTTP-01 method.
- PokestarFan 2y ago
  Certbot has a Cloudflare extension so all you need to do is provide a credentials file and it will automatically apply everything. I have a monthly cronjob running that runs the cloudflare certbot in Docker.
kuschku 2y ago
> Well, one of the "challenges" is the one in a different comment: most registrars don't allow fine-grained control over who can update what DNS records. Afaik, every major registrar allows you to add an NS record for the _acme-challenge subdomain, allowing you to put the _acme-challenge subdomain on a custom, self-hosted DNS server. That in turn allows you to make the permissions as specific as you'd like. Personally I just run powerdns in docker for this.
- TheNewsIsHere 2y ago
  Using CNAME delegation for the ACME challenge domain and directing that to a Route 53 zone is my preferred approach. Then (as long as you have CloudWatch configured) you get inherent auditing and very flexible privilege management.
  - cj 2y ago
    That wouldn't work for this use case though would it? AWS doesn't allow downloading the certificate (I could be wrong)? Typically certificates can only be used with other AWS services. E.g. you can't download the certificate and serve it from a home server.
    - vladvasiliu 2y ago
      You're not wrong, but the idea here is not to use AWS' certificate manager but their DNS service on which you would only handle the acme-challenge subdomain. This would allow you to limit who can update which subdomain. The LE cert is obtained normally.
- attentive 2y ago
  there is also https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns and LE clients like lego supporting it.
pnutjam 2y ago
I've had excellent controls using NearlyFreeSpeech.net for DNS (minor cost) and time4vps.com (free). Maybe very old registrars restrict DNS records..?

skinner927 2y ago

You don’t need automated DNS fiddling for lets encrypt. Certbot can either hook into Apache or NGINX, or run its own standalone server for verification.

jsheard 2y ago
You do need DNS fiddling if you want a wildcard cert, LE only accepts DNS challenges for those.
gunapologist99 2y ago
Aside from sibling comment, you also need automated DNS fiddling if you want CloudFlare Strict TLS support, because if LE can only connect to CF proxy, it will never issue via HTTPS.
- jsheard 2y ago
  You don't necessarily need to do that, Cloudflare can generate you a long-lived certificate to install on your origin server which isn't publicly trusted but is trusted by their proxies, so it works with Strict TLS. YMMV with other CDNs though, you might need to fall back to using LE with a DNS challenge in some cases. https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/ https://developers.cloudflare.com/ssl/origin-configuration/o...
- Arrowmaster 2y ago
  Not true. I have a CF rule that matches . well-known/acme-challenge and sets SSL off. The main setting is on full strict but the rule disables the auto redirect to https and the strict checking so an acme client behind a CF tunnel can bootstrap a cert with the HTTP-01 method.
PokestarFan 2y ago
Certbot has a Cloudflare extension so all you need to do is provide a credentials file and it will automatically apply everything. I have a monthly cronjob running that runs the cloudflare certbot in Docker.

kuschku 2y ago

> Well, one of the "challenges" is the one in a different comment: most registrars don't allow fine-grained control over who can update what DNS records. Afaik, every major registrar allows you to add an NS record for the _acme-challenge subdomain, allowing you to put the _acme-challenge subdomain on a custom, self-hosted DNS server. That in turn allows you to make the permissions as specific as you'd like. Personally I just run powerdns in docker for this.

TheNewsIsHere 2y ago
Using CNAME delegation for the ACME challenge domain and directing that to a Route 53 zone is my preferred approach. Then (as long as you have CloudWatch configured) you get inherent auditing and very flexible privilege management.
- cj 2y ago
  That wouldn't work for this use case though would it? AWS doesn't allow downloading the certificate (I could be wrong)? Typically certificates can only be used with other AWS services. E.g. you can't download the certificate and serve it from a home server.
  - vladvasiliu 2y ago
    You're not wrong, but the idea here is not to use AWS' certificate manager but their DNS service on which you would only handle the acme-challenge subdomain. This would allow you to limit who can update which subdomain. The LE cert is obtained normally.
attentive 2y ago
there is also https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns and LE clients like lego supporting it.

pnutjam 2y ago

I've had excellent controls using NearlyFreeSpeech.net for DNS (minor cost) and time4vps.com (free). Maybe very old registrars restrict DNS records..?