Hacker News Reader

Comment by raonyguimaraes | Hacker News Reader

I hope to see more built-in integration with Apache and Nginx web servers.

NixOS [1] actually has really great nginx integration with just a single line [2]:

    enableACME = true;

This automatically does the ACME thing and sets up systemd units to renew the certificate. Have been using it a while for my (sub)domains and it's worked really well.

[1]: https://nixos.org/

[2]: https://nixos.org/nixos/options.html#%3Cname%3E.enableacme

I know it's not directly what you've asked for (it's neither apache nor nginx), but the Caddy webserver does just that - almost 0 configuration dealing of the ACME part, auto-redirection from http to https. You still need to tell it what your domain name is, but barely (there's some DNS plugins that make it truely 0 config).

https://github.com/mholt/caddy

(I'm not affiliated, just a happy user)

Does caddy still stop the server if it can't access Let's Encrypt service even though certificate is valid?

The bug you're thinking of was Caddy would refuse to /start/ if the certificate needed renewing and Let's Encrypt was down.

They fixed that so that it has three weeks grace. Now only if you switch off the server wait until the cert has almost expired (say five days left) then switch it on, Caddy will go "eek, time to renew" and if Let's Encrypt is down it'll give up and the server doesn't start.

This means either Let's Encrypt was down for longer than a decent summer vacation or you switched off your own web site for weeks. Neither of those is a good idea.

No, Caddy never did that. Caddy never stopped serving a site that it started serving. Only by shutting down the server (or sending the appropriate signal) would it stop serving the site.

Setup for Apache with certbot was basically one command. Was even easier than copying and configuring existing SSL certificates.

So think that qualifies as a good integration.

Check out mod_md. It's upstreamed in Apache now.

The (beta) nginx certbot-auto module works flawlessly for me.

Reply on news.ycombinator.com