Technology

37800 readers

273 users here now

A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.

Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.

Subcommunities on Beehaw:

This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

founded 2 years ago

MODERATORS

[email protected]

Easy HTTPS for your private networks (www.getlocalcert.net)

submitted 1 year ago by [email protected] to c/[email protected]

22 comments fedilink hide all child comments

This webpage provides instructions for using the acme-dns DNS challenge method with various ACME clients to obtain HTTPS certificates for private networks. Caddy, Traefik, cert-manager, acme.sh, LEGO and Certify The Web are listed as ACME clients that support acme-dns. For each client, configuration examples are provided that show how to set API credentials and other settings to use the acme-dns service at https://api.getlocalcert.net/api/v1/acme-dns-compat to obtain certificates. Interesting that so many ACME clients support the acme-dns service, providing an easy way to obtain HTTPS certificates for private networks.

HN https://news.ycombinator.com/item?id=36674224

seiferteric: Proposes an idea for automatically creating trusted certificates for new devices on a private network.

hartmel: Mentions SCEP which allows automatic certificate enrollment for network devices.

mananaysiempre: Thinks using EJBCA for this, as hartmel suggested, adds unnecessary complexity.

8organicbits: Describes a solution using getlocalcert which issues certificates for anonymous domain names.

austin-cheney: Has a solution using TypeScript that checks for existing certificates and creates them if needed, installing them in the OS and browser.

bruce511: Says automating the process is possible.

lolinder: Mentions Caddy will automatically create and manage certificates for local domains.

frfl: Uses Lego to get a Let's Encrypt certificate for a local network website using the DNS challenge.

donselaar: Recommends DANE which works well for private networks without a public CA, but lacks browser support.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 7 points 1 year ago (3 children)

Big fan of letsencrypt’s certbot with the nginx and cloudflare (or other dns providers) plugins.

Is there any reason to use caddy or traefik over nginx?

[–] lchapman 6 points 1 year ago (1 children)

Caddy takes almost all of the nginx boilerplate and handles it for you.

If you’re doing something simple in nginx, it’s far simpler with Caddy.

[–] [email protected] 3 points 1 year ago (2 children)

What if I'm using NGINX Proxy Manager which gives me a GUI for my dumbness?

[–] lchapman 2 points 1 year ago

Stick with it, sounds like you’ve got a system that works for you

[–] [email protected] 1 points 1 year ago

You win

[–] [email protected] 4 points 1 year ago

I found traefik to be a more feature rich, load balancer when used in kubernetes environments. Other than use in kubernetes, I'd say if you're happy with nginx, keep using nginx :)

[–] [email protected] 1 points 1 year ago

I haven't tried it yet but I vaguely recall traefik had a better proxy-auth setup while nginx locked it away behind their freemium plan.