I’ve been downloading SSL certificates from my domain provider, using cat to join them together to make the fullchain.pem, uploading them to the server, and myself adding a 90 day calendar reminder. Every time I did this I’d think I should find out about this Certbot thing.

Well, I finally got around to it, and it was one of those jobs which turns out to be so easy you wish you’d done it ages ago.

The install was simple (I’m using nginx/ubuntu).

It scans up your server conf files to see which sites are being served, asks you a couple of questions, obtains the Let’s Encrypt certificate for them, installs it, updates your conf files to use it, and sets up a cron job to check if it’s time to renew the certificate, which it will also do auto-magically.

I was so pleased with it I made a donation to the EFF for it, then I started to think about how amazingly useful Let’s Encrypt is, and gave them one too. It’s just a really good time to be in this hobby.

I highly recommend Certbot. If you’ve been putting this off, or only just hearing about it, make some time for it.

  • steltek@lemm.ee
    link
    fedilink
    English
    arrow-up
    8
    ·
    1 year ago

    I’m obviously a fan of LE but a simple self-hosted option with a custom CA would be great for local machines:

    • I don’t want every Raspberry Pi/laptop/temp VM/whatever published into the cert transparency record
    • Configuring the router to forward every local hostname to the machine’s .well-known would be awful (if my ISP even allowed port 80)
    • Exposing local machines to the Internet is an unnecessary degradation of security
      • danA
        link
        fedilink
        English
        arrow-up
        5
        ·
        edit-2
        1 year ago

        +1

        I use acme-dns and it works very well. It’s a basic DNS server that only serves the Let’s Encrypt DNS challenges - it only allows clients to create TXT records, in the exact format that Let’s Encrypt needs. This is great for security as you don’t have to give Certbot/whatever full access to your main DNS servers.

        Let’s Encrypt followers CNAMEs which is how this works - you CNAME the _acme-challenge subdomain to point to a subdomain hosted by the acme-dns server.

        Let’s Encrypt is fine with IPv6-only DNS servers, so I have acme-dns running on one of my VPSes only over IPv6 (since I’m using the IPv4 for my regular DNS server). Good VPS providers provide a /64 IPv6 range.

        • skankhunt42@lemmy.ca
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          This… Is what I’ve wanted but never looked up if it was possible. Thank you. I’ve been manually renewing my cert for ages…

    • SirNuke@kbin.social
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      It’s easy* to setup Hashicorp Vault with your own CA and do automated cert generation and rotation, if you are willing to integrate everything into Vault and install your root CA everywhere. (*not really harder than any other Vault setup, but yaknow). I may go down this route eventually since I don’t think a device I don’t control has ever accessed anything I selfhost, or ever will.

      I have a wildcard subdomain pointing to my public IP, and forward port 80 to an LXC container with certbot. Port 80 appears closed outside the brief window when certbot is renewing certs. Inside my network I have my PiHole configured to return the local IP for each service.

      Nothing exposed to the internet at all. There is a record of my hostnames on Let’s Encrypt but not concerned if someone will, say, deduce apollo-idrac is the iDRAC service for a Dell rackmount server called apollo and the other Greek/Roman gods are VMs on it. Seemed like a house of cards that would never work reliably, but three odd years later I only have issues if a DNS resolver insists on bypassing my PiHole. And that DNS resolver is SystemD-ResolveD which should crawl back into whatever hellhole it came out of.

    • thirdBreakfast@lemmy.worldOP
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      My use case is for domains hosted on a VPS rather than my home server-hosted stuff. None of that is exposed to the internet except via Tailnet. I’ve got a domain saved up for that but haven’t figured it out how to do it since the CA can’t access my server to verify it. I have the feeling the answer is going to be ten more commenters telling me to check out Caddy.