Certbot is great. Let's Encrypt is great.

Submitted ⁨⁨1⁩ ⁨year⁩ ago⁩ by ⁨thirdBreakfast@lemmy.world⁩ to ⁨selfhosted@lemmy.world⁩

https://lemmy.world/pictrs/image/0f5cd047-5e18-4abb-ab65-f8410d961077.png

I’ve been downloading SSL certificates from my domain provider, using cat to join them together to make the fullchain.pem, uploading them to the server, and myself adding a 90 day calendar reminder. Every time I did this I’d think I should find out about this Certbot thing.

Well, I finally got around to it, and it was one of those jobs which turns out to be so easy you wish you’d done it ages ago.

The install was simple (I’m using nginx/ubuntu).

It scans up your server conf files to see which sites are being served, asks you a couple of questions, obtains the Let’s Encrypt certificate for them, installs it, updates your conf files to use it, and sets up a cron job to check if it’s time to renew the certificate, which it will also do auto-magically.

I was so pleased with it I made a donation to the EFF for it, then I started to think about how amazingly useful Let’s Encrypt is, and gave them one too. It’s just a really good time to be in this hobby.

I highly recommend Certbot. If you’ve been putting this off, or only just hearing about it, make some time for it.

source

Comments

Sort:hotnew top

tekeous@apollo.town ⁨1⁩ ⁨year⁩ ago
Wait until you find out about Caddy

source
- Appoxo@lemmy.dbzer0.com ⁨1⁩ ⁨year⁩ ago
  Or traefik
  
  source
  - ExLisper@linux.community ⁨1⁩ ⁨year⁩ ago
    traefik worked for me once. Then I tried to use it again in a different and I didn’t manage to get it to run. Caddy is much simpler. Traefik is more powerful but just for Let’s Encrypt I would go with Caddy.
    
    source
  - clb92@feddit.dk ⁨1⁩ ⁨year⁩ ago
    I took a look at Traefik once and the complexity scared me away. Caddy is my cup of tea with one simple config file.
    
    source
  - chandz05@lemmy.world ⁨1⁩ ⁨year⁩ ago
    Or swag ;)
    
    source
  - Lucidlethargy@sh.itjust.works ⁨1⁩ ⁨year⁩ ago
    Or Nginx Proxy Manager.
    
    source
    -> View More Comments
genuineparts@feddit.de ⁨1⁩ ⁨year⁩ ago
You know what, thanks for making this post. I have used Letsencrypt and Certbot for years now, i’d never have thought about donating, but since you said that I just made a donation.

source
- thirdBreakfast@lemmy.world ⁨1⁩ ⁨year⁩ ago
  Good on you. For anyone else inspired, you can support Certbot here, and Let’s Encrypt here.
  
  I promise I don’t work for them - I was just struck by how phenomenally handy they are.
  
  source
Ward@lemmy.nz ⁨1⁩ ⁨year⁩ ago
Certbot is great when using Nginx (or Apache2), but if you can use a different engine. Its worthwhile checking out Caddy!

source

Decronym@lemmy.decronym.xyz ⁨1⁩ ⁨year⁩ ago

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters	More Letters
DNS	Domain Name Service/System
HTTP	Hypertext Transfer Protocol, the Web
SSL	Secure Sockets Layer, for transparent encryption
TLS	Transport Layer Security, supersedes SSL
nginx	Popular HTTP server

[Thread #120 for this sub, first seen 8th Sep 2023, 16:25] [FAQ] [Full list] [Contact] [Source code]

source

Unsealed9041@lemmy.ca ⁨1⁩ ⁨year⁩ ago
If you like certbot, you should check out Caddy. Fully auto tls so long as the server resolves to a set domain name. Caddy-docker-proxy is pure magic with docker containers.

source
i_am_not_a_robot@discuss.tchncs.de ⁨1⁩ ⁨year⁩ ago
Downloading certificates from your domain provider is often a security problem. Only you are supposed to know your private keys.

source
- SheeEttin@lemmy.world ⁨1⁩ ⁨year⁩ ago
  You’re supposed to upload the CSR, not the key.
  
  But yeah, if they do all the generation themselves, they also have the private key and could easily break into anything the cert is used for.
  
  source
- thirdBreakfast@lemmy.world ⁨1⁩ ⁨year⁩ ago
  Good point. Although they are also hosting my DNS, so they can take the site over anytime they want anyway?
  
  source
  - SirNuke@kbin.social ⁨1⁩ ⁨year⁩ ago
    They could hijack your site at any time, but with a copy of your live private certs they (or more likely whatever third party that will invariably breach your domain provider) can decrypt your otherwise secure traffic.
    
    I don't think there's significant real tangible risk since who cares about your private selfhosted services and I'd be more worried about the domain being hijacked, and really any sort of network breach is probably interested in finding delicious credit card numbers and passwords and crypto private keys to munch on. If someone got into my network, spying on my Jellyfin streaming isn't what I'm going to be worried about.
    
    But it is why CSRs are used.
    
    source
    -> View More Comments
Kangie@lemmy.srcfiles.zip ⁨1⁩ ⁨year⁩ ago
I run all of my containerised services behind Traefik which does LetsEncrypt for me as well as handles fun stuff like routing to different containers / reverse proxy. It’s fantastic if you want to take your new knowledge to the next level!

source
- thirdBreakfast@lemmy.world ⁨1⁩ ⁨year⁩ ago
  Thanks, I do, and I’ve added a couple from the suggestions here. Caddy and Traefik are both on my list of things to investigate now.
  
  source
  - Kangie@lemmy.srcfiles.zip ⁨1⁩ ⁨year⁩ ago
    Here’s my config to get you started, I’ve got a bunch of services configured to work with it on my GitLab, too!
    
    gitlab.com/…/traefik-grafana-prometheus-docker
    
    source
- dan@upvote.au ⁨1⁩ ⁨year⁩ ago
  Traefik sounds interesting. I’m old-school so I still configure Nginx manually. I’ve got a bunch of snippets in /etc/nginx/snippets/ so a lot of the configuration is just importing the right snippets.
  
  On the other hand, there’s value in using the same software for both reverse proxies and regular websites. There’s only one configuration language to learn. I’ve been using Nginx for over 10 years so I’m very familiar with configuring it.
  
  source
vegetaaaaaaa@lemmy.world ⁨1⁩ ⁨year⁩ ago
Wait until you hear about mod_md

source
- CubitOom@infosec.pub ⁨1⁩ ⁨year⁩ ago
  Wait till you guys use cert-manager on a kubernetes cluster
  
  source
  - SheeEttin@lemmy.world ⁨1⁩ ⁨year⁩ ago
    Wait until you stand up your own CA and issue certs with multi-year validity so they don’t have to be renewed more often than you rebuild everything anyway
    
    At least until you try to access stuff on a Pixel phone which doesn’t let you install CA certs any more 😞
    
    source
    -> View More Comments
steltek@lemm.ee ⁨1⁩ ⁨year⁩ ago
I’m obviously a fan of LE but a simple self-hosted option with a custom CA would be great for local machines:

I don’t want every Raspberry Pi/laptop/temp VM/whatever published into the cert transparency record

Configuring the router to forward every local hostname to the machine’s .well-known would be awful (if my ISP even allowed port 80)

Exposing local machines to the Internet is an unnecessary degradation of security
source
- TheButtonJustSpins@infosec.pub ⁨1⁩ ⁨year⁩ ago
  Use DNS verification and wildcard certs and all this goes away.
  
  source
  - dan@upvote.au ⁨1⁩ ⁨year⁩ ago
    +1
    
    I use acme-dns and it works very well. It’s a basic DNS server that only serves the Let’s Encrypt DNS challenges - it only allows clients to create TXT records, in the exact format that Let’s Encrypt needs. This is great for security as you don’t have to give Certbot/whatever full access to your main DNS servers.
    
    Let’s Encrypt is fine with IPv6-only DNS servers, so I have acme-dns running on one of my VPSes only over IPv6 (since I’m using the IPv4 for my regular DNS server).
    
    source
    -> View More Comments
- csm10495@sh.itjust.works ⁨1⁩ ⁨year⁩ ago
  In theory you could generate a wildcard to a domain then use it.
  
  source
- SirNuke@kbin.social ⁨1⁩ ⁨year⁩ ago
  It's easy* to setup Hashicorp Vault with your own CA and do automated cert generation and rotation, if you are willing to integrate everything into Vault and install your root CA everywhere. (*not really harder than any other Vault setup, but yaknow). I may go down this route eventually since I don't think a device I don't control has ever accessed anything I selfhost, or ever will.
  
  I have a wildcard subdomain pointing to my public IP, and forward port 80 to an LXC container with certbot. Port 80 appears closed outside the brief window when certbot is renewing certs. Inside my network I have my PiHole configured to return the local IP for each service.
  
  Nothing exposed to the internet at all. There is a record of my hostnames on Let's Encrypt but not concerned if someone will, say, deduce apollo-idrac is the iDRAC service for a Dell rackmount server called apollo and the other Greek/Roman gods are VMs on it. Seemed like a house of cards that would never work reliably, but three odd years later I only have issues if a DNS resolver insists on bypassing my PiHole. And that DNS resolver is SystemD-ResolveD which should crawl back into whatever hellhole it came out of.
  
  source
- thirdBreakfast@lemmy.world ⁨1⁩ ⁨year⁩ ago
  My use case is for domains hosted on a VPS rather than my home server-hosted stuff. None of that is exposed to the internet except via Tailnet. I’ve got a domain saved up for that but haven’t figured it out how to do it since the CA can’t access my server to verify it. I have the feeling the answer is going to be ten more commenters telling me to check out Caddy.
  
  source
killwill@feddit.nl ⁨1⁩ ⁨year⁩ ago
I love the docker / traefik setup we have at work. We get tls certified domains for any docker container we run with just a few lines of yml. I can spin up a site in seconds.

source
MashedTech@lemmy.world ⁨1⁩ ⁨year⁩ ago
Yes it is, I love using cert-manager on my list cluster.

source
- BoneALisa@lemm.ee ⁨1⁩ ⁨year⁩ ago
  Just setup cert-manager for a client at our work thats moving to a Kubernetes cluster. Setup the ACME issuer using DNS Cloudflare challenges, its awesome how simple it is to even get internal hostnames with certs.
  
  source
ryannathans@lemmy.fmhy.net ⁨1⁩ ⁨year⁩ ago
Is it possible to change the elliptic curve yet or does it still throw suspicious errors

source