SSL now available for Tumblr blogs with custom domains | Hacker News Reader

SSL now available for Tumblr blogs with custom domains

security.tumblr.com

62 pointssprybear19 comments

How would one achieve this using LetsEncrypt?

I have a platform where my customers can use their own domain. But I am not sure of an easy (automated) way of doing this using LetsEncrypt.

There was a post awhile back that explained how Etsy does it (https://codeascraft.com/2017/01/31/how-etsy-manages-https-an...)

But it was wwaayy too much for a small startup like me.

I can think of a manual way of course.

I think caddy supports automagically combining multiple domains on LetsEncrypt certificate requests. It is possible to set it up as a proxy just to get certificates but be aware of rate limit issues, especially if a domain expires or otherwise becomes invalid.

https://caddyserver.com/

I was trying to use it temporarily as the simplest way to get a multi-domain LetsEncrypt cert on Windows, but ran out of time attempting to convert the resulting certificate format into something I could take back to IIS.

Those securing custom subdomains are looking forward to January 2018 when wildcard certificates arrive. https://letsencrypt.org/2017/07/06/wildcard-certificates-com...

By design, Caddy doesn't support SAN certificates:

https://github.com/mholt/caddy/issues/831

Thanks for clearing up my confusion. From the discussion there it looks like this project might meet OP's needs:

https://github.com/containous/traefik

Yes, it looks like Traefik handles SAN certificates from LE.

Let's Encrypt implements a protocol, or, if you prefer, an API called ACME, which is being standardized at IETF. This allows you to make software-based requests for certificates. You can implement an ACME client or adapt an existing one to make requests for certificates on behalf of your customers.

See

https://letsencrypt.org/docs/integration-guide/

There are a lot of clients, several dozen of them already. There isn't necessarily a client that's specifically oriented toward provider integration, but one of the lightweight clients like acme.sh might be a good fit because it will work well with external scripting.

valME.io, the blogging site I developed, has been doing this for years [1]. A user can provide their own SSL cert if they want but typically I just set them up via Let's Encrypt and then it does its automatic renewal process. If you're on a VPS, it's straight-forward to setup one of many ACME client alternatives [2]. If you're on shared hosting, it will depend on the hosting provider (some might even have it integrated if they use an administrative tool like Virtualmin).

[1] https://valme.io/c/gettingstarted/69qqs/valme-io-now-with-cu... [2] https://letsencrypt.org/docs/client-options/

I recently came across fly.io (possibly on HN) which looks like it may help here, at least in the interim while you're a small startup. To note they do it for you similar to how Cloudflare would do it - you route your site through them - so it may not be what you're looking for.

https://fly.io/mix/custom-hostnames/

No affiliation on my part, the service has just ticked enough "ooh" boxes I'm intrigued and am looking at using them for a project or two

I briefly checked out fly.io as a solution for this. It worked brilliantly.

I chose not to use fly.io though, because I was ultimately putting control of the DNS settings for all of my SaaS's custom domains in their hands.

The way I was going to do it personally was have customers point to a domain I control which then CNAMEs to the DNS record fly.io provides me. Not that I don't trust them or anything, but because I don't trust anyone completely :P In serious it was more to avoid any brand confusion.

At least that way I could in the worst case scenario cobble something together that replaces it in the event of a sunset or the likes

Great post from Etsy!

For NGINX and Apache it's a shell script away. The dehyrated shell client is Let's Encrypt/ACME compatible. It can read from a domains.txt file listing individual certificates per line. There's a hook.sh that you can modify to get dehydrated to deploy the script. All you'd have to do is get whatever script you currently use to provision the custom domains, to add the domains.txt and run dehyrated --cron.

There's plenty of pre-written deployment scripts for it, check the wiki and Google. https://github.com/lukas2511/dehydrated

Failing that... If you're using Apache, it's on its way to natively supporting Let's Encrypt certificates for fully auto HTTPS https://letsencrypt.org/2017/10/17/acme-support-in-apache-ht...

Hope that helps. If you're not comfortable doing it yourself, any dev/sysadmin should be able to cobble it together for a days consultancy.

How are they managing the content not specifically served over https? Do the scrap and download it, rewrite urls at their storage and re-serve back over https?

Most browsers will give a mixed-content warning, but still serve images.

Edit: found a reference[0] on the tumblr help site:

>Keep in mind that enabling the option for a theme that wasn’t developed to support SSL may cause “mixed content” errors. If your blog looks weird after you turn SSL on, some resources that the theme needs to render itself may not be getting loaded.

>If you're a theme developer and you'd like to ensure your themes support SSL, make sure that any externally hosted resources such as Cascading Style Sheets (CSS) or Javascript files are served either using HTTPS or a protocol-relative URL. If these files aren’t available over HTTPS, consider uploading them at the Theme Customization page (In your blog settings, click “Edit HTML” and then “Theme assets”).

[0]: https://tumblr.zendesk.com/hc/en-us/articles/226273528-Encry...

Does Tumblr actually allow the embedding of arbitrary images? I've never knowingly seen a Tumblr blog embed external ones; they always seem to be Tumblr-hosted.

Yes, Tumblr themes can contain arbitrary HTML. Letting Tumblr host theme assets is generally the easiest way to make them available though.

tumblr no longer allow custom domain i just check

What did you check? They still document it, I can't find an announcement otherwise and on my account I still have the option to enable it.

I've https for custom domain for like a month now. Please check again.

Reply on news.ycombinator.com