I'm still old school but can set this up all using the letsencrypt command line utilities that configure everything for me.
Oh, and whatever the hell GoDaddy's intermediate chain certificate was.
I'm still old school but can set this up all using the letsencrypt command line utilities that configure everything for me.
Oh, and whatever the hell GoDaddy's intermediate chain certificate was.
Actually Apache recently introduced mod_md, which allows provisioning certificates from Let's Encrypt directly (or anything else that supports ACME): https://httpd.apache.org/docs/2.4/mod/mod_md.html
Because of this, you no longer need external software like certbot for Apache (though it's good software regardless: https://certbot.eff.org/pages/about), so in that regard Apache is a bit more like Caddy (another good web server: https://caddyserver.com/), rather than like Nginx.
I wrote about it and other configurations of Apache on my blog a while back: https://blog.kronis.dev/tutorials/how-and-why-to-use-apache-... Since, I've actually moved most of my personal workloads from Nginx/Caddy over to Apache, because at my scale the web server isn't the bottleneck and if you disable .htaccess to limit disk I/O it's pretty decent, in addition to lots of different modules.
Either way, working a bit more with certificates, even with tools that simplify the process, is a nice way to understand everything a bit better, like running your own CA: https://blog.kronis.dev/tutorials/lets-run-our-own-ca I still have lots to learn, at least when I want to get pretty particular about mTLS and what some client certificates can or cannot be used for.
Of course, any software that actually helps you get things done, is user friendly and has ample (correct) tutorials available is a good option in my book, regardless of what your particular choice ends up being! Let's Encrypt as a whole is an absolute life saver, though! Edit: even if it feels like a looming massive single point of failure with few viable alternatives sometimes.
That said, I like its configuration format a bit more than Apache and there's just way less ceremony around it in those cases where it's suitable for any of your projects - you just install it and run it, with any config you might need typically in a single file.
With Apache, you find yourself needing to think a little bit more about what modules you have installed and enabled, although there are actually plenty of those out there, for most things you might want to do (e.g. an authentication gateway or something to make it act as a simple web application firewall).
Re: Godaddy, I was using their "EV" (Extended Validation) cert which added a company name indicator in the address bar. I then learned that it's unwise to bring up security when someone isn't thinking about it because it puts them on undue alert. A couple years ago the browsers have done away with that EV badge altogether.
Customers were seeing the prominent green text and assuming a heightened level of security and trust.
Legal names are also not unique, and this loophole could be used for phishing.
Instead, what browsers did was promote SSL as a default (regardless of certificate type) and point out HTTP connections as insecure.