I’ve been downloading SSL certificates from my domain provider, using cat to join them together to make the fullchain.pem, uploading them to the server, and myself adding a 90 day calendar reminder. Every time I did this I’d think I should find out about this Certbot thing.
Well, I finally got around to it, and it was one of those jobs which turns out to be so easy you wish you’d done it ages ago.
The install was simple (I’m using nginx/ubuntu).
It scans up your server conf files to see which sites are being served, asks you a couple of questions, obtains the Let’s Encrypt certificate for them, installs it, updates your conf files to use it, and sets up a cron job to check if it’s time to renew the certificate, which it will also do auto-magically.
I was so pleased with it I made a donation to the EFF for it, then I started to think about how amazingly useful Let’s Encrypt is, and gave them one too. It’s just a really good time to be in this hobby.
I highly recommend Certbot. If you’ve been putting this off, or only just hearing about it, make some time for it.
Wait until you find out about Caddy
Or traefik
traefik worked for me once. Then I tried to use it again in a different and I didn’t manage to get it to run. Caddy is much simpler. Traefik is more powerful but just for Let’s Encrypt I would go with Caddy.
Or Nginx Proxy Manager.
So many tools. Yet not enough time.
I took a look at Traefik once and the complexity scared me away. Caddy is my cup of tea with one simple config file.
I don’t use compose.
I highly recommend https://github.com/acmesh-official/acme.sh
This is what I use because fuck snap. I used certbot to do wild card certs but once they went to snap I quit.
If you don’t like snap, maybe you should try another distro instead (I went to fedora because I was annnoyed of snaps).
That’s exactly the same reason I dropped certbot, haha
On Debian you can
apt install certbotand it’s just a regular Debian package with Python files inside. Are you on Ubuntu? I know they’ve been pushing snaps for a while.
I also use acme.sh. It has worked great for me and was dead simple to use. Super flexible on what it can do from just renewing the certs to web server integration. Love the simple to use hooks available too.
You know what, thanks for making this post. I have used Letsencrypt and Certbot for years now, i’d never have thought about donating, but since you said that I just made a donation.
Certbot is great when using Nginx (or Apache2), but if you can use a different engine. Its worthwhile checking out Caddy!
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters DNS Domain Name Service/System HTTP Hypertext Transfer Protocol, the Web IP Internet Protocol LXC Linux Containers PiHole Network-wide ad-blocker (DNS sinkhole) SSL Secure Sockets Layer, for transparent encryption TLS Transport Layer Security, supersedes SSL VPS Virtual Private Server (opposed to shared hosting) nginx Popular HTTP server
7 acronyms in this thread; the most compressed thread commented on today has 6 acronyms.
[Thread #120 for this sub, first seen 8th Sep 2023, 16:25] [FAQ] [Full list] [Contact] [Source code]
If you like certbot, you should check out Caddy. Fully auto tls so long as the server resolves to a set domain name. Caddy-docker-proxy is pure magic with docker containers.
Yes it is, I love using cert-manager on my list cluster.
Just setup cert-manager for a client at our work thats moving to a Kubernetes cluster. Setup the ACME issuer using DNS Cloudflare challenges, its awesome how simple it is to even get internal hostnames with certs.
Downloading certificates from your domain provider is often a security problem. Only you are supposed to know your private keys.
I’m obviously a fan of LE but a simple self-hosted option with a custom CA would be great for local machines:
- I don’t want every Raspberry Pi/laptop/temp VM/whatever published into the cert transparency record
- Configuring the router to forward every local hostname to the machine’s .well-known would be awful (if my ISP even allowed port 80)
- Exposing local machines to the Internet is an unnecessary degradation of security
Use DNS verification and wildcard certs and all this goes away.
In theory you could generate a wildcard to a domain then use it.
