Hacker News Reader

Comment by RL_Quine | Hacker News Reader

So delegate the validation with a CNAME and do it somewhere that’s not cloudflare. They provide signing with their own CA for origin certificates so I don’t really know why you’re using Let’s Encrypt at all.

Your idea of just randomly blocking access from certain IP address ranges doesn’t really provide you with any security at all. If you’re worried about rusaian hackers or whatever, most people exploiting anything have access to botnets with whatever bespoke IP address ranges they need to bypass those sort of rules.

In anti fraud we see this commonly, people using stolen details will happily get better matches with GEOIP than the legitimate users of the credentials. Blocking specific countries IP allocations is just providing a false sense security on your part.

View on HN

Even with CloudFlare in front of your servers, it is still valuable to use Let's Encrypt certificates. You can turn on Full Strict SSL validation to the backend and reduce another attack vector. It's an unlikely attack vector to be exploited but it's also a trivial amount of work to implement.

Every layer of security makes attacks that much more costly.

Like I said cloudflare signs certificates for your origin as well.

And if you always use Cloudflare (or at least are sure you'd have days-weeks not minutes-hours between making a decision to cease using Cloudflare and actually executing) then it's actually safer to tell them you'll use their Origin certs rather than a public CA as well as likely being easier.

> So delegate the validation with a CNAME and do it somewhere that’s not cloudflare.

Like? For what price?

> Blocking specific countries IP allocations is just providing a false sense security on your part.

No, it's a preventative measure. Just like changing SSH to a non-standard port reduces pointless attempts.

> Like? For what price?

If you own example.com, you can delegate to dnsauth.example.com for $0 (or simply the price of a Internet-facing machine that has DNS open).

Say you want a cert for www.example.com. LE will check for ownership by looking up _acme-challenge.www.example.com. Instead of having a TXT record with the nonce, _acme-challenge.www is actually a CNAME pointing to _acme-challenge.www.dnsauth--where the TXT nonce lives.

The DNS daemon that is authoritative for dnsauth can be the traditional BIND, or other software:

* https://github.com/joohoi/acme-dns

This is often called 'DNS alias' mode:

* https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo...

* https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...

I did not ask "how", I wished to know who supports a DNS service like that and for what price.

The parent stated that you can run your own DNS server temporarily for the cost of the hardware to run the server and shut the DNS server off after the certificate has been issued. The cost is basically free.

Any DNS service which allows you to create a CNAME RR supports it. You delegate the subdomain to any DNS server you wish.

This isn't some special "Let's Encrypt DNS forwarding mode" that DNS providers have to explicitly support. It's simply part of "how DNS works".

> Any DNS service which allows you to create a CNAME RR supports it.

And which of those also have an API that is supported by Certbot?

I would really like names where a setup like this has been tested and works.

> And which of those also have an API that is supported by Certbot?

Certbot allows for hook scripts, and you can use a utility that can talk multiple APIs:

* https://github.com/AnalogJ/lexicon

> I would really like names where a setup like this has been tested and works.

The guy who runs BSDCan and PgCon uses it for his personal stuff as well as FreshPorts.org, etc:

* https://dan.langille.org/2017/05/31/creating-a-txt-only-nsup...

* https://dan.langille.org/2019/02/01/acme-domain-alias-mode/

He used acme.sh, though I'm more partial to dehydrated:

* https://github.com/dehydrated-io/dehydrated/wiki/example-dns...

We use it at work, but I don't want to dox myself. :)

> I did not ask "how", I wished to know who supports a DNS service like that and for what price.

And as I stated in the very first sentence, it is self-serve:

> If you own example.com, you can delegate to dnsauth.example.com for $0 (or simply the price of a Internet-facing machine that has DNS open).

We do this at work: our main registrar does not have a restricted API, so we have a sub-domain that lives on a DNS server in our DMZ. Internal ACME clients update the desired TXT records when asking LE for a cert.

The cost is the price for keeping a VM running and updated, which for us is minimal since it is on our private cloud.

Reply on news.ycombinator.com