Hacker News Reader

Hacker News

Comment by StavrosK | Hacker News Reader

Full thread

StavrosK

All the Let's Encrypt automation I want to see is:

sudo service nginx start

And nginx gets/renews certificates automatically.

View on HN

That's where we'd like to see things go as well. Same for Apache. -Josh, head of Let's Encrypt

isnt building an official lua script an option (like https://github.com/torhve/lua-resty-letsencrypt)

Right this is exactly what the Letsencrypt folks are trying to solve. Thank you for your work Josh! SSL has been a pain in the ass for decades! Generating certs, deploying them, maintaining them. This is why we are not at 100% SSL on the web. The LE folks are trying to fix this. Please send a few dollars their way on their fund raising page to help this goal along.

It's not unobtainable to make using certs MUCH easier and automated, their work should be supported by us all.

Don't forget haproxy!

Caddy, another web server, does this.

Yes, I use caddy extensively for non-production/internal and personal projects.

Wanted to point out the same. It's sort of marketed towards designers/less technical folk, but even to the seasoned developer it represents potentially less time faffing, and should be viable for at least for MVP or personal projects.

Caddy is mostly just unproven at high scale; theoretically, nginx should be able to handle greater loads, but I wonder what Caddy's limits are and how big the difference would be. Haven't found time to benchmark them head-to-head.

I'm using Caddy for almost all my personal projects, with the exception of those setups that are too complex to replicate in a Caddyfile.

I think we're all just waiting for people to really test its performance under heavy loads and give it a chance to prove itself (or not).

You don't need to restart nginx; reloading suffices. Moreover, it's good to test the configuration before restarting/reloading:

  nginx -t && sudo service nginx reload

Here's a Dockerized version of NGINX that does just that: https://github.com/occrp/watchful-nginx it also generates the dhparam file if there's isn't one and handles proper log rotations.

disclosure: I work with OCCRP and have submitted pull requests on this.

I'm pretty sure this only targets usage by small individual VPSs or something. For hosting services, especially with multiple nginx frontends, things are different.

As long as nginx doesn't block on startup if it can't get the cert ;)

"sudo service nginx certify" would be nice though.

What would you have it do instead?

Ideally there would be a cutover period. E.g. a month before the cert expires, attempt to renew on startup, and write a warning to log if that fails.

But what if it hasn't obtained a cert for the site before (e.g. first run)?

What if the cert doesn't expire in a month -- but only, say, 7 days? 7 minutes? Where do you draw the line? Would you rather have your site go red in browsers or just not have the server start? (Remember, it wasn't started already anyway so it's not like your sites are incurring new downtime.)

Eh, the new run might be a failover, or part of an autoscaling setup, so maybe there could be some downtime? I think the default setting has to be to start anyway, although of course any particular service could be configured not to. Intentional failure seems kind of a blunt instrument?

Thanks for communicating my thoughts on this in this thread far better than I. Spot on.

If it doesn't block when it can't get a cert, then it becomes very easy for someone to break the security of your site. They just have to block the network path to LetsEncrypt, and then your server will come up without encryption.

We've built a script like this internally, but would love to see it as an NGINX module :)

While we're at it, can we make it that easy for Weechat relays?

It's complicated a one-fits-all solution. We ended using the S3 as storage back-end to provision, also to get a single cert for all frontend instances.

Reply on news.ycombinator.com