enjay Posted April 20, 2020 Posted April 20, 2020 Does anyone know anything about Let's Encrypt? They are a free provider of SSL certificates, and the SSL certificate on our main website is provided by them. It is automatically renewing itself, so I'm not immediately worried but I would like to understand how it is working. Also, as we have a wildcard *.schoolname.com SSL certificate from GoDaddy, I'm a bit confused as to why we're not using that on http://www.schoolname.com (or even how we can have two certs from two providers for the same domain name).
FN-GM Posted April 20, 2020 Posted April 20, 2020 I have used them for years. In fact I configured it today for a website. They are a non profit organisation that provides free ssl certificates and is funded by big players such as Google, Cisco Mozilla etc. It is used because its easy, certificates are automatically requested and installed. The only admin intervention is when you set it up for the first time. It saves lots of messing about.
mavhc Posted April 20, 2020 Posted April 20, 2020 Lets Encrypt provide most of the world's certificates, they invented a way to have short lived certificates that auto renew via software installed on your server that checks every day for it running out and automatically gets a new one. Unless you specify otherwise any CA can make a cert for you, which is bad if one is evil. Do you use the wildcard cert for other things?
enjay Posted April 20, 2020 Author Posted April 20, 2020 Lets Encrypt provide most of the world's certificates, they invented a way to have short lived certificates that auto renew via software installed on your server that checks every day for it running out and automatically gets a new one. That's what is happening on our website, the certificate only lasts 3 months and is obviously auto-renewing. Now I just need to work out where it is set up! Do you use the wildcard cert for other things? Yes. A number of our internal servers have IIS sites running on them which are externally accessible, e.g. IT helpdesk, finance portal. Also, one of my predecessors seemed to like doing this for on-premise products which have browser-based interfaces (e.g. our wifi controller is accessible wifi.schoolname.com, we have papercut.schoolname.com) possibly so we could either hide or change the IP addresses behind the interfaces.
enjay Posted April 21, 2020 Author Posted April 21, 2020 Also can't have https without a dns name really Sorry, I don't understand what you mean.
SimonHooker Posted April 21, 2020 Posted April 21, 2020 It's possible to have LetsEncrypt provision wildcard certificates, but does require a bit of configuration. I recently moved our SaaS product over to LetsEncrypt to reduce the overhead of renewing the certificates (and of course to remove the cost) and in the end also migrated over our wildcards, which was nice. Ownership of regular domains / subdomains requires proving you own the domain. Typically this can be done by putting a specific file in a specific publicly accessible location, in turn proving you have access to the webserver behind the domain. The other option is to alter the DNS records to add a TXT record again proving ownership. For wildcards, you need to perform the DNS option to prove ownership of the root domain. It's certainly made my life easier when it comes to HTTPS provisioning!
enjay Posted April 21, 2020 Author Posted April 21, 2020 It's possible to have LetsEncrypt provision wildcard certificates, but does require a bit of configuration. I recently moved our SaaS product over to LetsEncrypt to reduce the overhead of renewing the certificates (and of course to remove the cost) and in the end also migrated over our wildcards, which was nice. Having just seen the renewal price for our wildcard certificate with Go Daddy, that's tempting. Was it a lot of work? Any factors I should consider before I decide?
chris11256 Posted April 21, 2020 Posted April 21, 2020 Having just seen the renewal price for our wildcard certificate with Go Daddy, that's tempting. Was it a lot of work? Any factors I should consider before I decide? I've recently used LeysEncrypt for a wildcard. On the server concerned I installed the 'CertifytheWeb' program wich mostly automates the process. Only step I had to do was add a DNS entry to prove we owned the domain. Depending on your DNS provider that can sometimes be automatic as well. But after adding the entry & click proceed it then generated the certificate. Something I'll happily do every 90 days to save in certificate renewal costs(we had a GoDaddy wildcard as well).
DGardiner Posted April 21, 2020 Posted April 21, 2020 I use letencrypt for our websites, automated through cpanel. I also use it for our smoothwalls reverse proxy, thought i have to hoop jump every 3 months to renew it using a docker container on my laptop its pretty painless...
SimonHooker Posted April 21, 2020 Posted April 21, 2020 Having just seen the renewal price for our wildcard certificate with Go Daddy, that's tempting. Was it a lot of work? Any factors I should consider before I decide? It wasn't so bad, and would have been easier if I wasn't dealing with a few hundred domains at the same time! I used certbot to automate the process and have a .sh script to update the TXT record for the applicable domain to confirm ownership for the wildcard. This is all done by a CodeBuild plan so I could hook it up to other events to automate, but could be replicated in a simple shell script. 1
enjay Posted April 22, 2020 Author Posted April 22, 2020 Great, thanks. Maybe a job for later in the term.
mavhc Posted April 22, 2020 Posted April 22, 2020 Sorry, I don't understand what you mean. You can't have a certificate for 10.0.0.5 or whatever your internal server is, but can have one for wifi.mydomain.com that resolves to 10.0.0.5, so https://10.x.y.z or https://192.168.x.y with just an ip address will never have a correct certificate. You can technically have one for a public ip address, but it's rare.
mavhc Posted December 1, 2021 Posted December 1, 2021 https://docs.linuxserver.io/images/docker-swag#parameters is a docker container that will auto renew a wildcard cert using dns "Dns options are aliyun, cloudflare, cloudxns, cpanel, desec, digitalocean, directadmin, dnsimple, dnsmadeeasy, dnspod, domeneshop, gandi, gehirn, google, he, hetzner, infomaniak, inwx, ionos, linode, luadns, netcup, njalla, nsone, ovh, rfc2136, route53, sakuracloud, transip and vultr" Cloudflare is free, you can export a dns record from your current host and import it into cloudflare by going to dns and then advanced, any import errors popup at the bottom of the page
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now