Hacker News Reader

Comment by sideproject | Hacker News Reader

How would one achieve this using LetsEncrypt?

I have a platform where my customers can use their own domain. But I am not sure of an easy (automated) way of doing this using LetsEncrypt.

There was a post awhile back that explained how Etsy does it (https://codeascraft.com/2017/01/31/how-etsy-manages-https-an...)

But it was wwaayy too much for a small startup like me.

I can think of a manual way of course.

View on HN

Let's Encrypt implements a protocol, or, if you prefer, an API called ACME, which is being standardized at IETF. This allows you to make software-based requests for certificates. You can implement an ACME client or adapt an existing one to make requests for certificates on behalf of your customers.

See

https://letsencrypt.org/docs/integration-guide/

There are a lot of clients, several dozen of them already. There isn't necessarily a client that's specifically oriented toward provider integration, but one of the lightweight clients like acme.sh might be a good fit because it will work well with external scripting.

I think caddy supports automagically combining multiple domains on LetsEncrypt certificate requests. It is possible to set it up as a proxy just to get certificates but be aware of rate limit issues, especially if a domain expires or otherwise becomes invalid.

https://caddyserver.com/

I was trying to use it temporarily as the simplest way to get a multi-domain LetsEncrypt cert on Windows, but ran out of time attempting to convert the resulting certificate format into something I could take back to IIS.

Those securing custom subdomains are looking forward to January 2018 when wildcard certificates arrive. https://letsencrypt.org/2017/07/06/wildcard-certificates-com...

By design, Caddy doesn't support SAN certificates:

https://github.com/mholt/caddy/issues/831

Thanks for clearing up my confusion. From the discussion there it looks like this project might meet OP's needs:

https://github.com/containous/traefik

Yes, it looks like Traefik handles SAN certificates from LE.

I recently came across fly.io (possibly on HN) which looks like it may help here, at least in the interim while you're a small startup. To note they do it for you similar to how Cloudflare would do it - you route your site through them - so it may not be what you're looking for.

https://fly.io/mix/custom-hostnames/

No affiliation on my part, the service has just ticked enough "ooh" boxes I'm intrigued and am looking at using them for a project or two

I briefly checked out fly.io as a solution for this. It worked brilliantly.

I chose not to use fly.io though, because I was ultimately putting control of the DNS settings for all of my SaaS's custom domains in their hands.

The way I was going to do it personally was have customers point to a domain I control which then CNAMEs to the DNS record fly.io provides me. Not that I don't trust them or anything, but because I don't trust anyone completely :P In serious it was more to avoid any brand confusion.

At least that way I could in the worst case scenario cobble something together that replaces it in the event of a sunset or the likes

For NGINX and Apache it's a shell script away. The dehyrated shell client is Let's Encrypt/ACME compatible. It can read from a domains.txt file listing individual certificates per line. There's a hook.sh that you can modify to get dehydrated to deploy the script. All you'd have to do is get whatever script you currently use to provision the custom domains, to add the domains.txt and run dehyrated --cron.

There's plenty of pre-written deployment scripts for it, check the wiki and Google. https://github.com/lukas2511/dehydrated

Failing that... If you're using Apache, it's on its way to natively supporting Let's Encrypt certificates for fully auto HTTPS https://letsencrypt.org/2017/10/17/acme-support-in-apache-ht...

Hope that helps. If you're not comfortable doing it yourself, any dev/sysadmin should be able to cobble it together for a days consultancy.

valME.io, the blogging site I developed, has been doing this for years [1]. A user can provide their own SSL cert if they want but typically I just set them up via Let's Encrypt and then it does its automatic renewal process. If you're on a VPS, it's straight-forward to setup one of many ACME client alternatives [2]. If you're on shared hosting, it will depend on the hosting provider (some might even have it integrated if they use an administrative tool like Virtualmin).

[1] https://valme.io/c/gettingstarted/69qqs/valme-io-now-with-cu... [2] https://letsencrypt.org/docs/client-options/

Great post from Etsy!

Reply on news.ycombinator.com