4 ms·

TLS-only servers needing babysitting is mostly a failing of older projects like nginx which leave certificate management as an exercise for the user - newer pro

TLS-only servers needing babysitting is mostly a failing of older projects like nginx which leave certificate management as an exercise for the user - newer projects like Caddy and Traefik have shown that for simple deployments it can be made almost completely transparent with automatic ACME provisioning. Caddy can even gracefully handle cases where a certificate is unexpectedly revoked, by provisioning a new one immediately. It really does Just Work™.

saurik 2y ago
I don't know if it handles this unexpected-revocation scenario, but as Apache has had support for automated Let's Encrypt for a while now (I finally upgraded last week, when I realized I was missing out on this feature), I'm surprised that nginx doesn't?
- __s 2y ago
  It does, just not out of the box https://certbot.eff.org/instructions?ws=nginx&os=arch https://certbot.eff.org/instructions?ws=nginx&os=arch
  - saurik 2y ago
    I don't know if I agree that this is "it does" as this isn't really "not out of the box" and kind of "fully external", but what I continue to be surprised by is that Apache DOES come with this functionality, "out of the box" (via a first-party module--and btw everything in Apache is built out of modules, including protocols--that ships with Apache and is configured inside of Apache), while nginx doesn't. I feel like the decision to use Apache has been vindicated throughout the ages, time and time again ;P. (There was a very short period of time when nginx was "faster", but not only did the world move on to ubiquitous CDNs anyway, but Apache quickly responded with mpm_event, which eventually became the default.)
- uncanneyvalley 2y ago
  I believe they mean ACME provisioning and renewal isn't baked into nginx, i.e. you have to install certbot separately and run it daily from a cron job or systemd timer, whereas traefik and caddy handle this for you without additional software or configuration.
  - saurik 2y ago
    I understood that. As Apache does have a way for me to internally automate all of that, without using an external tool such as certbot, I am surprised that nginx doesn't as well. Either way, you should add Apache to your list of servers, along with caddy and traefik.
superkuh 2y ago
Newer indeed. Caddy isn't even 10 years old itself yet. I'm not sure how you can be sure it's all-in-one is going to handle long times gracefully. But for short term few to handful of years use cases, sure.

saurik 2y ago

I don't know if it handles this unexpected-revocation scenario, but as Apache has had support for automated Let's Encrypt for a while now (I finally upgraded last week, when I realized I was missing out on this feature), I'm surprised that nginx doesn't?

__s 2y ago
It does, just not out of the box https://certbot.eff.org/instructions?ws=nginx&os=arch https://certbot.eff.org/instructions?ws=nginx&os=arch
- saurik 2y ago
  I don't know if I agree that this is "it does" as this isn't really "not out of the box" and kind of "fully external", but what I continue to be surprised by is that Apache DOES come with this functionality, "out of the box" (via a first-party module--and btw everything in Apache is built out of modules, including protocols--that ships with Apache and is configured inside of Apache), while nginx doesn't. I feel like the decision to use Apache has been vindicated throughout the ages, time and time again ;P. (There was a very short period of time when nginx was "faster", but not only did the world move on to ubiquitous CDNs anyway, but Apache quickly responded with mpm_event, which eventually became the default.)
uncanneyvalley 2y ago
I believe they mean ACME provisioning and renewal isn't baked into nginx, i.e. you have to install certbot separately and run it daily from a cron job or systemd timer, whereas traefik and caddy handle this for you without additional software or configuration.
- saurik 2y ago
  I understood that. As Apache does have a way for me to internally automate all of that, without using an external tool such as certbot, I am surprised that nginx doesn't as well. Either way, you should add Apache to your list of servers, along with caddy and traefik.

superkuh 2y ago

Newer indeed. Caddy isn't even 10 years old itself yet. I'm not sure how you can be sure it's all-in-one is going to handle long times gracefully. But for short term few to handful of years use cases, sure.