8 ms·
> The current preview implementation supports HTTP-01 challenges to verify the client’s domain ownership. DNS-01 is probably the most impactful for users of ng
by Shank 1y ago
> The current preview implementation supports HTTP-01 challenges to verify the client’s domain ownership.
DNS-01 is probably the most impactful for users of nginx that isn't public facing (i.e., via Nginx Proxy Manager). I really want to see DNS-01 land! I've always felt that it's also one of the cleanest because it's just updating some records and doesn't need to be directly tethered to what you're hosting.
- samgranieri 1y agoI use dns01 in my homelab with step-ca with caddy. It's a joy to use
- reactordev 1y ago+1 for caddy. nginx is so 2007.
- supriyo-biswas 1y agoOnly if they'd get the K8s ingress out of the WIP phase; I can't wait to possibly get rid of the cert-manager and ingress shenanigans you get with others.
- reactordev 1y agoYup. I can’t wait for the day I can kill my caddy8s service. The best thing about caddy is the fact you can reload config, add sites, routes, without ever having to shutdown. Writing a service to keep your orchestration platform and your ingress in sync is meh. K8s has the events, DNS service has the src mesh records, you just need a way to tell caddy to send it to your backend. The feature should be done soon but they need to ensure it works across K8s flavors.
- 01HNNWZ0MV43FF 1y agoI think you can that with Nginx too, but the SWAG wrapper discourages it for some reason
- pushrax 1y agojust send sighup to nginx and it will reload all the config—there's very few settings that require a restart
- reactordev 1y agoSure, how, from the container? The host it’s on? Caddy exposes this as an api.
- ilogik 1y agoTraefik seems to be ok for us
- darkwater 1y agoCaddy is just for developers that want to publish/test the thing they write. For power users or infra admins, nginx is still much more valuable. And yes, I use Caddy in my home lab and it's nice and all but it's not really flexible as nginx is.
- reactordev 1y agoCaddy is in use here in production. 14M requests an hour.
- mholt 1y agoWhere's that if I may ask?
- reactordev 1y agoTrust me, you don’t want to know. Just know - it’s working great and thank you. GovCloud be dragons.
- selfmodruntime 1y agoWe use Caddy across hundreds of apps with 10s of millions of requests per day in production.
- mholt 1y agoOooh. Can you tell me more about this?
- reactordev 1y agoIn case people are wondering, this is the author of Caddy. He’s curious where it’s being used outside of home labs and in small shops. Matt, it’s fantastic software and will only get better as go improves. I used it in a proxy setup for ingress to kubernetes that’s overlayed across multiple clouds - for the government (prior admin, this admin killed it). I can’t tell you more information than that. Other than it goes WWW -> ALB -> Caddy Cluster * Other Cloud -> K8s Router -> K8s pod -> Fiber Golang service. :chefs kiss: When a pod is registered to the K8s router, we fire off a request to the caddy cluster to register the route. Bam, we got traffic, we got TLS, we got magic. No downtime.
- RadiozRadioz 1y agoSo a tool's value should be judged as inversely proportional to its age?
- mholt 1y agoMaybe inversely proportional to how much the ecosystem moves around it.
- reactordev 1y agoA tools value is in the eye of the beholder. Nginx has ceased being valuable to me when they decided to change licenses, go private equity, not adapt to orchestration needs, ignore http standards, and not release meaningful updates in a decade.
- yjftsjthsd-h 1y ago> when they decided to change licenses, https://github.com/nginx/nginx/blob/master/LICENSE https://github.com/nginx/nginx/blob/master/LICENSE looks like a nice normal permissive license. I don't care that there's a premium version if all the features I want are in the OSS version.
- jcgl 1y agoPrivate equity? Either there’s a story I’m missing, or you’re mischaracterizing F5 as PE.
- reactordev 1y agoLookup Angie, freenginx, and the whole Rambler / F5 fiasco. Moscow feds involved and forced exploitation for profit.
- clvx 1y agoBut you have to have your dns api key loaded and many dns providers don’t allow api keys per zone. I do like it but a compromise could be awful.
- grim_io 1y agoSounds like a DNS provider problem. Why would Nginx feel the need to compromise because of some 3rd party implementation detail?
- toomuchtodo 1y agoBecause users would pick an alternative solution that meets their needs when they don't have leverage or ability to change DNS provider. Have to meet users where they are when they have options.
- bananapub 1y agono you don't, you can just run https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns anywhere, and then CNAME _acme_challenge.realdomain.com to aklsfdsdl239072109387219038712.acme-dns.anywhere.com. then your ACME client just talks to the ACME DNS api, which let's it do nothing at all aside from deal with challenges for that one long random domain.
- rglullis 1y agoI've been hoping to get ACME challenge delegation on traefik working for years already. The documentation says it supports it, but it simply fails every time. If you have any idea how this tool would work on a docker swarm cluster, I'm all ears.
- Arnavion 1y agoYou can do it with an NS record, ie _acme_challenge.realdomain.com pointing to the DNS server that you can program to serve the challenge response. No need to make a CNAME and involve an additional domain in the middle.
- Spivak 1y agoI don't even know why anyone wouldn't use the DNS challenge unless they had no other option. I've found it to be annoying and brittle, maybe less so now with native web server support. And you can't get wildcards.
- cortesoft 1y agoMy work is mostly running internal services that aren’t reachable from the external internet. DNS is the only option. You can get wildcards with DNS. If you want *.foo.com, you just need to be able to set _acme-challenge.foo.com and you can get the wildcard.
- bryanlarsen 1y ago> DNS is the only option DNS and wildcards aren't the only options. I've done annoying hacks to give internal services an HTTPS cert without using either. But they're the only sane options.
- deleted 1y ago[deleted]
- filleokus 1y agoSpivak is saying that the DNS method is superior (i.e you are agreeing - and I do too). One reason I can think of for HTTP-01 / TLS-ALPN-01 is on-demand issuance, issuing the certificate when you get the request. Which might seem insane (and kinda is), but can be useful for e.g crazy web-migration projects. If you have an enormous, deeply levelled, domain sprawl that are almost never used but you need it up for some reason it can be quite handy. (Another reason, soon, is that HTTP-01 will be able to issue certs for IP addresses: https://letsencrypt.org/2025/07/01/issuing-our-first-ip-address-certificate https://letsencrypt.org/2025/07/01/issuing-our-first-ip-addr...)
- cortesoft 1y agoOh I totally misread the comment. Nevermind, I agree!
- creatonez 1y agoWhy would nginx ever need support for the DNS-01 challenge type? It always has access to `.well-known` because nginx is running an HTTP server for the entire lifecycle of the process, so you'd never need to use a lower level way of doing DV. And that seems to violate the principle of least privilege, since you now need a sensitive API token on the server.
- lukeschlather 1y agoIssuing a new certificate with the HTTP challenge pretty much requires you allow for 15 minutes of downtime. It's really not suitable for any customer-facing endpoint with SLAs.
- deleted 1y ago[deleted]
- kijin 1y agoOnly if you let certbot take down your normal nginx and occupy port 80 in standalone mode. Which it doesn't need to, if normal nginx can do the job by itself. When I need to use the HTTP challenge, I always configure the web server in advance to serve /.well-known/ from a certain directory and point certbot at it with `certbot certonly --webroot-path`. No need to take down the normal web server. Graceful reload. Zero downtime. Works with any web server.
- chrismorgan 1y agoSounds like you’re doing it wrong. I don’t know about this native support, but I’d be very surprised if it was worse than the old way, which could just have Certbot put files in a path NGINX was already serving (webroot method), and then when new certificates are done send a signal for NGINX to reload its config. There should never be any downtime.
- kijin 1y agoCertbot has a "standalone" mode that occupies port 80 and serves /.well-known/ by itself. Whoever first recommended using that mode in anything other than some sort of emergency situation needs to be given a firm kick in the butt. Certbot also has a mode that mangles your apache or nginx config files in an attempt to wire up certificates to your virtual hosts. Whoever wrote the nginx integration also needs a butt kick, it's terrible. I've helped a number of people fix their broken servers after certbot mangled their config files. Just because you're on a crusade to encrypt the web doesn't give you a right to mess with other programs' config files, that's not how Unix works!
- chaz6 1y agoOne of Traefik's shortcomings with ACME is that you can only use one api key per DNS provider. This is problematic if you want to restrict api keys to a domain, or use domains belonging to two different accounts. I hope Nginx will not have the same constraint.
- mholt 1y agoThis is one of the main reasons Caddy stopped using lego for ACME and I wrote our own ACME stack.
- navigate8310 1y agoYou can use CNAME to handle multiple DNS challenge providers. https://doc.traefik.io/traefik/reference/install-configuration/tls/certificate-resolvers/acme/#dnschallenge https://doc.traefik.io/traefik/reference/install-configurati...
- kijin 1y agoA practical problem with DNS-01 is that every DNS provider has a different API for creating the required TXT record. Certbot has more than a dozen plugins for different providers, and the list is growing. It shouldn't be nginx's job to keep track of all these third-party APIs. It would also be unreasonable to tell everyone to move their domains to a handful of giants like AWS and Cloudflare who already control so much of the internet, just so they could get certificates with DNS-01. I like my DNS a bit more decentralized than that.
- sureglymop 1y agoThat is true and it is annoying. They should really just support RFC 2136 instead of building their own APIs. Lego also supports this and pretty much all DNS servers have it implemented. At least I can use it with my own DNS server... https://datatracker.ietf.org/doc/html/rfc2136 https://datatracker.ietf.org/doc/html/rfc2136
- cpach 1y agoThis is a very good point. I wonder what a good solution to this would be? In theory, Nginx could call another application that handles the communication with the DNS provider, so that the user can tailor it to their needs. (The user could write it in Python or Go or whatever.) Not sure how robust that would be though.
- attentive 1y agoYes, ACME-DNS please - https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns Lego supports it.
- altairprime 1y agoDoes DNS-01 support DNS-over-HTTPS to the registered domain name servers? If so, then it should be extremely simple to extend nginx to support DNS claims; if not, perhaps DNS-01 needs improvements.
- cpach 1y agoWhen placing the order, you get a funny text string from the ACME provider. You need to create a TXT record that holds this value. How you create the TXT record is up to you and your DNS server – the ACME provider doesn’t care. I don’t believe DNS-over-HTTPS is relevant in this context. AFAIK, it’s used by clients who want to query a DNS server, and not for an operator who wants to create a DNS record. (Please correct me if I’m wrong.)
- 0x0000000 1y agoThe ACME provider makes a query to the DNS server to validate the record exists and contains the right "funny string". Parent's question was whether that query is/can be made via DoH.
- cpach 1y agoPerhaps I have poor imagination, but I fail to see why why it would matter?
- 0x0000000 1y agoBecause nginx, as an HTTP server, could answer the query?
- Arrowmaster 1y agoYou want to build a DNS server into nginx so you can respond to DoH query's for the domain you are hosting on that nginx server? Let's ignore that DoH is a client oriented protocol and there's no same way to only run a DoH server without an underlying DNS server. How do you plan to get the first certificate so the query to the DoH server doesn't get rejected for invalid certificate?
- uncleJoe 1y agono need to wait: https://en.angie.software/angie/docs/configuration/modules/http/http_acme/ https://en.angie.software/angie/docs/configuration/modules/h... (angie is the nginx fork lead by original nginx developers that left f5)
- tmcdos 1y agoWhat are the main differences between Angie and freenginX.org ?
- aoe6721 1y agoSwitch to Angie then. It supports DNS-01 very well.
- klysm 1y agoHow does NGINX fit into that though?
- geek_at 1y agoI am using a bash script on my vps to get a wildcard certificate and just scp the cert to my other reverse proxies. Some using nginx but some Caddy or traefik Wrote an article how to set it up https://blog.haschek.at/2023/letsencrypt-wildcard-cert.html https://blog.haschek.at/2023/letsencrypt-wildcard-cert.html
- rfmoz 1y agoThe problem with DNS-01 is that you can only use one delegation a time. I mean, if you configure a wildcard cert with _acme-challenge.example.com in Google, you couldn't use it in Cloudflare, because it uses a single DNS authorization label (subdomain). The solution has been evolving along these years and currently the las IETF draft is https://datatracker.ietf.org/doc/draft-ietf-acme-dns-account-label/ https://datatracker.ietf.org/doc/draft-ietf-acme-dns-account... The new proposal brings the dns-account-01 challenge, incorporating the ACME account URL into the DNS validation record name.