5 ms·

I've run DNS servers in the past - BIND and pdns. I've now gone all in ... because ... well it started with ACME. As the OP states you can get a registrar to

by gerdesj 7mo ago

I've run DNS servers in the past - BIND and pdns. I've now gone all in ... because ... well it started with ACME. As the OP states you can get a registrar to host a domain for you and then you create a subdomain anywhere you fancy and that includes at home. Do get the glue records right and do use dig to work out what is happening. Now with a domain under your own control, you can use CNAME records in other zones to point at your zones and if you have dynamic DNS support on your zones (RFC 2136) then you can now support ACME ie Lets Encrypt and Zerossl and co. Sadly certbot doesn't do (or it didn't) CNAME redirects for ACME. However, acme.sh and simple-acme do and both are absolutely rock solid. Both of those projects are used by a lot of people and well trod. acme.sh is ideal for unix gear and if you follow this blokes method of installation: https://pieterbakker.com/acme-sh-installation-guide-2025/ https://pieterbakker.com/acme-sh-installation-guide-2025/ usefully centralised. simple-acme is for Windows. It has loads of add on scripts to deal with scenarios. Those scripts seem to be deprecated but work rather well. Quite a lot of magic here that an old school Linux sysadmin is glad of. PowerDNS auth server supports dynamic DNS and you can filter access by IP and TSIG-KEY, per zone and/or globally. Join the dots. [EDIT: Speling, conjunction switch]

9dev 7mo ago
Seconded. Don’t use certbot; it’s an awful piece of user-hostile software, starting from snap being the only supported installation channel. Everything it does wrong, acme.sh does right.
- tryauuum 7mo ago
  just installed yesterday the certbot on ubuntu 24.04, from the default repos, without any snaps
  - mediumsmart 7mo ago
    same on debian trixie. certbot works fine for me. Zone records in bind, generate the dnskey, cronjob to re-sign it daily and your off to the races. no problems no snaps.
- locknitpicker 7mo ago
  > starting from snap being the only supported installation channel. This sounds like you are complaining about Ubuntu, not the software you wish to install in Ubuntu.
  - jcgl 7mo ago
    Unfortunately, it's more than that: the Linux installation instructions on the certbot website[0] give options for pip or snap. Distro packages are not mentioned. [0] https://certbot.eff.org/ https://certbot.eff.org/
    - pgporada 7mo ago
      Make a PR or an issue on the project.
      - jcgl 7mo ago
        I feel no need to. I'm quite certain that the certbot folks are aware of the existence of distro packages and even know how to check https://pkgs.org/download/certbot https://pkgs.org/download/certbot for availability. One might guess that they only want to supply instructions for upstream-managed distribution channels rather than dealing with e.g. some ancient version being shipped on Debian.
adiabatichottub 7mo ago
I'm a fan of uACME: https://github.com/ndilieto/uacme https://github.com/ndilieto/uacme Tiny, simple, reliable. What more can you ask?
- DaSHacka 7mo ago
  Neat, I've used lego (https://github.com/go-acme/lego https://github.com/go-acme/lego) but will certainly have to give uacme a look, love me a simple ACME client. acme.sh was too garish for my liking, even as a guy that likes his fair share of shell scripts. And obviously certbot is a non-starter because of snap.
  - adiabatichottub 7mo ago
    Certbot has earned my ire on just about every occasion I've had to interact with it. It is a terrible program and I can't wait to finish replacing it everywhere. The new setup is using uAcme and nsupdate to do DNS-01 challenges. No more fiddling with any issues in the web server config for a particular virtual host, like some errant rewrite rule that prevents access to .well-known/.
    - Spivak 7mo ago
      I mean certbot handles the just issue me a cert via DNS-01 and I'll do the rest flow just fine. Massive overkill of a program for just that use-case but it's been humming along for me for years at this point. What's the selling point for uACME?
  - catlifeonmars 7mo ago
    Lego is solid. I use it with Route53 to do automatic renewal of LE certs for various endpoints before the certs expire.
- dwedge 7mo ago
  > don't expect it to automatically set up your webserver to use the certificates it obtains. This makes me so happy. Acme and certbot trying to do this is annoying, Caddy trying to get certs by default is annoying. I ended up on a mix of dehydrated and Apache mod_md but I think I like the look of uACME because dehydrated just feels clunky
ozim 7mo ago
I think CNAME redirections being not supported is reasonable choice. Would make my life easier as well but it opens all kinds of bad possibilities that bad actors would definitely use.
- dwedge 7mo ago
  Can you give me an example where this is a problem? If someone can create a CNAME they can create a TXT (ignoring the possibility of an API being restricted to just one). Without CNAME redirect I wouldn't be able to automatically renew wildcard ssl for client domains with dns that has no API. Even if they do have an API, doing it this way stops me from needing to deal with two different APIs
  - rdevilla 7mo ago
    GP comment is just vague distilled model AI slop.
    - ozim 7mo ago
      I don’t need a crutch I am perfectly capable of writing vague slop on my own thank you.
  - ozim 7mo ago
    People forget configurations and CNAME can be left when domain it was pointing to changes owner. Then someone unauthorized can make certs for not his domain.
    - dwedge 7mo ago
      Ok I asked for an example and you provided one, that's fair. It also makes the second domain a target. I had someone issue a cert on one of my subdomains because I forgot to remove DNS after cancelling a VPS, and the VPS provider didn't remove the reverse DNS so they found it. Small attack, but it happened.
rdevilla 7mo ago
> Sadly certbot doesn't do (or it didn't) CNAME redirects for ACME. Are you certain? Not at a real machine at the moment so hard for me to dig into the details but CNAMEing the challenge response to another domain is absolutely supported via DNS-01 [0] and certbot is Let's Encrypt's recommended ACME client: [1] Since Let’s Encrypt follows the DNS standards when looking up TXT records for DNS-01 validation, you can use CNAME records or NS records to delegate answering the challenge to other DNS zones. This can be used to delegate the _acme-challenge subdomain to a validation specific server or zone. ... which is a very common pattern I've seen hundreds (thousands?) of times. The issue you may have run into is that CNAME records are NOT allowed at the zone apex, for RFC 1033 states: The CNAME record is used for nicknames. [...] There must not be any other RRs associated with a nickname of the same class. ... of course making it impossible to enter NS, SOA, etc. records for the zone root when a CNAME exists there. P.S. doing literally fucking anything on mobile is like pulling teeth encased in concrete. Since this is how the vast majority of the world interfaces with computing I am totally unsurprised that people are claiming 10x speedups with LLMs. [0] https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/ [1] https://letsencrypt.org/docs/client-options/ https://letsencrypt.org/docs/client-options/
- jcalvinowens 7mo ago
  I tried this too a couple months ago, OP is right, certbot doesn't support the CNAME aliases: it lacks logic to add the TXT record to the redirected name, instead of the name in the certificate. I use acme.sh which does support it: https://news.ycombinator.com/item?id=47066072 https://news.ycombinator.com/item?id=47066072
  - rdevilla 7mo ago
    I still find this hard to believe without some actual example RRs and certbot configs, but this is HN, not serverfault.
    - jcalvinowens 7mo ago
      I remember being annoyed because the docs don't actually say you can't do it: https://certbot-dns-rfc2136.readthedocs.io/en/stable/ https://certbot-dns-rfc2136.readthedocs.io/en/stable/ ...but they also don't say how to specify the zone to be updated like acme.sh does: https://github.com/acmesh-official/acme.sh/blob/master/dnsapi/dns_nsupdate.sh#L10 https://github.com/acmesh-official/acme.sh/blob/master/dnsap... So say you want a cert for *.foo.com, and you have: _acme-challenge.foo.com CNAME _acme-challenge.foo.bar.com ...I can make certbot talk to the foo.bar.com DNS server, but it tries to add the TXT record for _acme-challenge.foo.com, which that DNS server obviously rejects (and even if it accepted it, that obviously wouldn't work). I'd be happy to hear there's a way to do it that I missed. Also I'm specifically talking about the rfc2136 support, maybe some of the proprietary certbot backends do support this. EDIT: Here are more references: https://github.com/certbot/certbot/issues/6566 https://github.com/certbot/certbot/issues/6566 https://github.com/certbot/certbot/pull/5350 https://github.com/certbot/certbot/pull/5350 https://github.com/certbot/certbot/pull/6644 https://github.com/certbot/certbot/pull/6644

by gerdesj 7mo ago

9dev 7mo ago

Seconded. Don’t use certbot; it’s an awful piece of user-hostile software, starting from snap being the only supported installation channel. Everything it does wrong, acme.sh does right.

tryauuum 7mo ago
just installed yesterday the certbot on ubuntu 24.04, from the default repos, without any snaps
- mediumsmart 7mo ago
  same on debian trixie. certbot works fine for me. Zone records in bind, generate the dnskey, cronjob to re-sign it daily and your off to the races. no problems no snaps.
locknitpicker 7mo ago
> starting from snap being the only supported installation channel. This sounds like you are complaining about Ubuntu, not the software you wish to install in Ubuntu.
- jcgl 7mo ago
  Unfortunately, it's more than that: the Linux installation instructions on the certbot website[0] give options for pip or snap. Distro packages are not mentioned. [0] https://certbot.eff.org/ https://certbot.eff.org/
  - pgporada 7mo ago
    Make a PR or an issue on the project.
    - jcgl 7mo ago
      I feel no need to. I'm quite certain that the certbot folks are aware of the existence of distro packages and even know how to check https://pkgs.org/download/certbot https://pkgs.org/download/certbot for availability. One might guess that they only want to supply instructions for upstream-managed distribution channels rather than dealing with e.g. some ancient version being shipped on Debian.

adiabatichottub 7mo ago

I'm a fan of uACME: https://github.com/ndilieto/uacme https://github.com/ndilieto/uacme Tiny, simple, reliable. What more can you ask?

DaSHacka 7mo ago
Neat, I've used lego (https://github.com/go-acme/lego https://github.com/go-acme/lego) but will certainly have to give uacme a look, love me a simple ACME client. acme.sh was too garish for my liking, even as a guy that likes his fair share of shell scripts. And obviously certbot is a non-starter because of snap.
- adiabatichottub 7mo ago
  Certbot has earned my ire on just about every occasion I've had to interact with it. It is a terrible program and I can't wait to finish replacing it everywhere. The new setup is using uAcme and nsupdate to do DNS-01 challenges. No more fiddling with any issues in the web server config for a particular virtual host, like some errant rewrite rule that prevents access to .well-known/.
  - Spivak 7mo ago
    I mean certbot handles the just issue me a cert via DNS-01 and I'll do the rest flow just fine. Massive overkill of a program for just that use-case but it's been humming along for me for years at this point. What's the selling point for uACME?
- catlifeonmars 7mo ago
  Lego is solid. I use it with Route53 to do automatic renewal of LE certs for various endpoints before the certs expire.
dwedge 7mo ago
> don't expect it to automatically set up your webserver to use the certificates it obtains. This makes me so happy. Acme and certbot trying to do this is annoying, Caddy trying to get certs by default is annoying. I ended up on a mix of dehydrated and Apache mod_md but I think I like the look of uACME because dehydrated just feels clunky

ozim 7mo ago

I think CNAME redirections being not supported is reasonable choice. Would make my life easier as well but it opens all kinds of bad possibilities that bad actors would definitely use.

dwedge 7mo ago
Can you give me an example where this is a problem? If someone can create a CNAME they can create a TXT (ignoring the possibility of an API being restricted to just one). Without CNAME redirect I wouldn't be able to automatically renew wildcard ssl for client domains with dns that has no API. Even if they do have an API, doing it this way stops me from needing to deal with two different APIs
- rdevilla 7mo ago
  GP comment is just vague distilled model AI slop.
  - ozim 7mo ago
    I don’t need a crutch I am perfectly capable of writing vague slop on my own thank you.
- ozim 7mo ago
  People forget configurations and CNAME can be left when domain it was pointing to changes owner. Then someone unauthorized can make certs for not his domain.
  - dwedge 7mo ago
    Ok I asked for an example and you provided one, that's fair. It also makes the second domain a target. I had someone issue a cert on one of my subdomains because I forgot to remove DNS after cancelling a VPS, and the VPS provider didn't remove the reverse DNS so they found it. Small attack, but it happened.

rdevilla 7mo ago

> Sadly certbot doesn't do (or it didn't) CNAME redirects for ACME. Are you certain? Not at a real machine at the moment so hard for me to dig into the details but CNAMEing the challenge response to another domain is absolutely supported via DNS-01 [0] and certbot is Let's Encrypt's recommended ACME client: [1] Since Let’s Encrypt follows the DNS standards when looking up TXT records for DNS-01 validation, you can use CNAME records or NS records to delegate answering the challenge to other DNS zones. This can be used to delegate the _acme-challenge subdomain to a validation specific server or zone. ... which is a very common pattern I've seen hundreds (thousands?) of times. The issue you may have run into is that CNAME records are NOT allowed at the zone apex, for RFC 1033 states: The CNAME record is used for nicknames. [...] There must not be any other RRs associated with a nickname of the same class. ... of course making it impossible to enter NS, SOA, etc. records for the zone root when a CNAME exists there. P.S. doing literally fucking anything on mobile is like pulling teeth encased in concrete. Since this is how the vast majority of the world interfaces with computing I am totally unsurprised that people are claiming 10x speedups with LLMs. [0] https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/ [1] https://letsencrypt.org/docs/client-options/ https://letsencrypt.org/docs/client-options/

jcalvinowens 7mo ago
I tried this too a couple months ago, OP is right, certbot doesn't support the CNAME aliases: it lacks logic to add the TXT record to the redirected name, instead of the name in the certificate. I use acme.sh which does support it: https://news.ycombinator.com/item?id=47066072 https://news.ycombinator.com/item?id=47066072
- rdevilla 7mo ago
  I still find this hard to believe without some actual example RRs and certbot configs, but this is HN, not serverfault.
  - jcalvinowens 7mo ago
    I remember being annoyed because the docs don't actually say you can't do it: https://certbot-dns-rfc2136.readthedocs.io/en/stable/ https://certbot-dns-rfc2136.readthedocs.io/en/stable/ ...but they also don't say how to specify the zone to be updated like acme.sh does: https://github.com/acmesh-official/acme.sh/blob/master/dnsapi/dns_nsupdate.sh#L10 https://github.com/acmesh-official/acme.sh/blob/master/dnsap... So say you want a cert for *.foo.com, and you have: _acme-challenge.foo.com CNAME _acme-challenge.foo.bar.com ...I can make certbot talk to the foo.bar.com DNS server, but it tries to add the TXT record for _acme-challenge.foo.com, which that DNS server obviously rejects (and even if it accepted it, that obviously wouldn't work). I'd be happy to hear there's a way to do it that I missed. Also I'm specifically talking about the rfc2136 support, maybe some of the proprietary certbot backends do support this. EDIT: Here are more references: https://github.com/certbot/certbot/issues/6566 https://github.com/certbot/certbot/issues/6566 https://github.com/certbot/certbot/pull/5350 https://github.com/certbot/certbot/pull/5350 https://github.com/certbot/certbot/pull/6644 https://github.com/certbot/certbot/pull/6644