this post was submitted on 08 Sep 2023
586 points (97.9% liked)

Selfhosted

39987 readers
433 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
586
Certbot is great. Let's Encrypt is great. (lemmy.world)
submitted 1 year ago by [email protected] to c/[email protected]
56 comments fedilink hide all child comments
 

I've been downloading SSL certificates from my domain provider, using cat to join them together to make the fullchain.pem, uploading them to the server, and myself adding a 90 day calendar reminder. Every time I did this I'd think I should find out about this Certbot thing.

Well, I finally got around to it, and it was one of those jobs which turns out to be so easy you wish you'd done it ages ago.

The install was simple (I'm using nginx/ubuntu).

It scans up your server conf files to see which sites are being served, asks you a couple of questions, obtains the Let's Encrypt certificate for them, installs it, updates your conf files to use it, and sets up a cron job to check if it's time to renew the certificate, which it will also do auto-magically.

I was so pleased with it I made a donation to the EFF for it, then I started to think about how amazingly useful Let's Encrypt is, and gave them one too. It's just a really good time to be in this hobby.

I highly recommend Certbot. If you've been putting this off, or only just hearing about it, make some time for it.

top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 30 points 1 year ago (1 children)

You know what, thanks for making this post. I have used Letsencrypt and Certbot for years now, i'd never have thought about donating, but since you said that I just made a donation.

[–] [email protected] 7 points 1 year ago

Good on you. For anyone else inspired, you can support Certbot here, and Let's Encrypt here.

I promise I don't work for them - I was just struck by how phenomenally handy they are.

[–] [email protected] 27 points 1 year ago

Certbot is great when using Nginx (or Apache2), but if you can use a different engine. Its worthwhile checking out Caddy!

[–] [email protected] 24 points 1 year ago (2 children)

I highly recommend https://github.com/acmesh-official/acme.sh

[–] [email protected] 9 points 1 year ago (4 children)

This is what I use because fuck snap. I used certbot to do wild card certs but once they went to snap I quit.

[–] [email protected] 5 points 1 year ago

This seems like free hate as you can use certbot without snap without any problems. Imagine stopping using Firefox because of the same reason for example

[–] [email protected] 5 points 1 year ago* (last edited 1 year ago) (2 children)

On Debian you can apt install certbot and it's just a regular Debian package with Python files inside. Are you on Ubuntu? I know they've been pushing snaps for a while.

load more comments (2 replies)
[–] [email protected] 3 points 1 year ago

That's exactly the same reason I dropped certbot, haha

load more comments (1 replies)
[–] [email protected] 3 points 1 year ago (1 children)

I also use acme.sh. It has worked great for me and was dead simple to use. Super flexible on what it can do from just renewing the certs to web server integration. Love the simple to use hooks available too.

[–] [email protected] 1 points 1 year ago

Certbot has hooks too.

[–] [email protected] 16 points 1 year ago* (last edited 1 year ago)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
DNS Domain Name Service/System
HTTP Hypertext Transfer Protocol, the Web
IP Internet Protocol
LXC Linux Containers
PiHole Network-wide ad-blocker (DNS sinkhole)
SSL Secure Sockets Layer, for transparent encryption
TLS Transport Layer Security, supersedes SSL
VPS Virtual Private Server (opposed to shared hosting)
nginx Popular HTTP server

7 acronyms in this thread; the most compressed thread commented on today has 6 acronyms.

[Thread #120 for this sub, first seen 8th Sep 2023, 16:25] [FAQ] [Full list] [Contact] [Source code]

[–] [email protected] 14 points 1 year ago

If you like certbot, you should check out Caddy. Fully auto tls so long as the server resolves to a set domain name. Caddy-docker-proxy is pure magic with docker containers.

[–] [email protected] 11 points 1 year ago (2 children)

I run all of my containerised services behind Traefik which does LetsEncrypt for me as well as handles fun stuff like routing to different containers / reverse proxy. It's fantastic if you want to take your new knowledge to the next level!

[–] [email protected] 2 points 1 year ago (1 children)

Thanks, I do, and I've added a couple from the suggestions here. Caddy and Traefik are both on my list of things to investigate now.

[–] [email protected] 2 points 1 year ago

Here's my config to get you started, I've got a bunch of services configured to work with it on my GitLab, too!

https://gitlab.com/Matt.Jolly/traefik-grafana-prometheus-docker

[–] [email protected] 1 points 1 year ago

Traefik sounds interesting. I'm old-school so I still configure Nginx manually. I've got a bunch of snippets in /etc/nginx/snippets/ so a lot of the configuration is just importing the right snippets.

On the other hand, there's value in using the same software for both reverse proxies and regular websites. There's only one configuration language to learn. I've been using Nginx for over 10 years so I'm very familiar with configuring it.

[–] [email protected] 8 points 1 year ago (4 children)

I'm obviously a fan of LE but a simple self-hosted option with a custom CA would be great for local machines:

  • I don't want every Raspberry Pi/laptop/temp VM/whatever published into the cert transparency record
  • Configuring the router to forward every local hostname to the machine's .well-known would be awful (if my ISP even allowed port 80)
  • Exposing local machines to the Internet is an unnecessary degradation of security
[–] [email protected] 12 points 1 year ago (1 children)

Use DNS verification and wildcard certs and all this goes away.

[–] [email protected] 5 points 1 year ago* (last edited 1 year ago) (1 children)

+1

I use acme-dns and it works very well. It's a basic DNS server that only serves the Let's Encrypt DNS challenges - it only allows clients to create TXT records, in the exact format that Let's Encrypt needs. This is great for security as you don't have to give Certbot/whatever full access to your main DNS servers.

Let's Encrypt followers CNAMEs which is how this works - you CNAME the _acme-challenge subdomain to point to a subdomain hosted by the acme-dns server.

Let's Encrypt is fine with IPv6-only DNS servers, so I have acme-dns running on one of my VPSes only over IPv6 (since I'm using the IPv4 for my regular DNS server). Good VPS providers provide a /64 IPv6 range.

load more comments (1 replies)
[–] [email protected] 2 points 1 year ago

In theory you could generate a wildcard to a domain then use it.

load more comments (2 replies)
[–] [email protected] 8 points 1 year ago

I love the docker / traefik setup we have at work. We get tls certified domains for any docker container we run with just a few lines of yml. I can spin up a site in seconds.

[–] [email protected] 8 points 1 year ago (1 children)

Wait until you hear about mod_md

[–] [email protected] 14 points 1 year ago (1 children)

Wait till you guys use cert-manager on a kubernetes cluster

[–] [email protected] 14 points 1 year ago (5 children)

Wait until you stand up your own CA and issue certs with multi-year validity so they don't have to be renewed more often than you rebuild everything anyway

At least until you try to access stuff on a Pixel phone which doesn't let you install CA certs any more 😞

[–] [email protected] 16 points 1 year ago (3 children)

Having certificates that are valid for over a year is contra-productive, as when they get in to the wrong hands they might still be valid for a year until they naturally run out of time. The reason LetsEncrypt issues only 90d valid certificates is not to annoy you, but save your ass once someone obtains your certificates.

[–] [email protected] 8 points 1 year ago

Which they will, because we are all bad at security.

[–] [email protected] 5 points 1 year ago (1 children)

While shorter lived certs certainly improve the general security, certificate revocation lists are what you need if a cert gets compromised.

[–] [email protected] 7 points 1 year ago

They don’t work in practice, no modern browser actively queries any revocation DBs. It’s just much more efficient to let something expire sooner than keep track of all lost somethings.

[–] [email protected] 1 points 1 year ago

Exactly this. The CA/B forum (who make rules about TLS certificates that all the providers follow) are actively trying to reduce certificate validity periods. 2-3 years ago, they reduced the maximum duration for TLS certificates to 13 months. It's likely they'll go even lower in the future.

My understanding is that they want the entire industry to move towards a Let's Encrypt style system where renewal is fully automated and thus there's minimal overhead to renewing more frequently. We're not quite there yet.

[–] [email protected] 5 points 1 year ago

Wait until you set up cert-manager to issue both Let's Encrypt certificates, as well as generating your own CA and issuing certs from your own CA where you can set the validity however want.

[–] [email protected] 2 points 1 year ago* (last edited 1 year ago) (1 children)

I had no problem to install my CA on my Pixel (Android 13). I read that this was not possible for some time but Google changed it.

[–] [email protected] 1 points 1 year ago

I've heard something about it changing with A14

[–] [email protected] 1 points 1 year ago

That's a lot of work just to avoid a renewal process that's fully automated. Seems counter productive.

[–] [email protected] 1 points 1 year ago

Pixel phone which doesn’t let you install CA certs any more

Is that something new? I can still install CA certs on my Pixel 6. It does give a scary warning, but you can just click through it.

[–] [email protected] 4 points 1 year ago (1 children)

Yes it is, I love using cert-manager on my list cluster.

[–] [email protected] 2 points 1 year ago

Just setup cert-manager for a client at our work thats moving to a Kubernetes cluster. Setup the ACME issuer using DNS Cloudflare challenges, its awesome how simple it is to even get internal hostnames with certs.

[–] [email protected] 4 points 1 year ago (2 children)

Downloading certificates from your domain provider is often a security problem. Only you are supposed to know your private keys.

[–] [email protected] 31 points 1 year ago

You're supposed to upload the CSR, not the key.

But yeah, if they do all the generation themselves, they also have the private key and could easily break into anything the cert is used for.

[–] [email protected] 3 points 1 year ago (1 children)

Good point. Although they are also hosting my DNS, so they can take the site over anytime they want anyway?

[–] [email protected] 8 points 1 year ago (1 children)

They could hijack your site at any time, but with a copy of your live private certs they (or more likely whatever third party that will invariably breach your domain provider) can decrypt your otherwise secure traffic.

I don't think there's significant real tangible risk since who cares about your private selfhosted services and I'd be more worried about the domain being hijacked, and really any sort of network breach is probably interested in finding delicious credit card numbers and passwords and crypto private keys to munch on. If someone got into my network, spying on my Jellyfin streaming isn't what I'm going to be worried about.

But it is why CSRs are used.

[–] [email protected] 2 points 1 year ago

Thanks - I hadn't considered the traffic decryption.

[–] [email protected] 1 points 1 year ago

Is it possible to change the elliptic curve yet or does it still throw suspicious errors

load more comments
view more: next ›