Hacker News Reader

Comment by vbezhenar | Hacker News Reader

My ideal certificate issuance process should look as follows:

I create private key.

I publish corresponding public key at some standard DNS record.

Then I can curl http://letsencrypt.org/cert/mywebsite.com and letsencrypt responds with certificate (probably cached unless it decides to issue new one).

So I can spend some time preparing this DNS configuration and then writing simple cronjob to fetch certificate every day and restart apache.

That would be vastly superior to current certbot horror and as secure.

View on HN

> So I can spend some time preparing this DNS configuration and then writing simple cronjob to fetch certificate every day and restart apache.

> That would be vastly superior to current certbot horror and as secure.

Have you looked at Apache's mod_md, which allows you to integrate with ACME providers without certbot?

Here's the documentation, it's available since Apache 2.4.30: https://httpd.apache.org/docs/2.4/mod/mod_md.html

Configuration example from the docs:

  MDomain example.org
  
  <VirtualHost *:443>
      ServerName example.org
      DocumentRoot htdocs/a
  
      SSLEngine on
      # no certificates specification
  </VirtualHost>

(you do need restarts/reloads to actually apply the provisioned certificates though, that part is up to you; I do it approx. daily since the startup is fast enough to not cause lots of downtime)

I actually wrote a blog post about using Apache for that and other things, and moved my personal workloads over to it (still using Nginx and other servers at work): https://blog.kronis.dev/tutorials/how-and-why-to-use-apache-...

In short, in addition to having lots of useful modules, Apache has recently gotten the aforementioned ACME functionality, which makes it a bit more easy to use, like how web servers like Caddy also have "automatic HTTPS" functionality: https://caddyserver.com/

I'm yet to find a good self-hosted WAF solution, since mod_security doesn't seem popular or documented enough, even though it is better than nothing.

What you describe sounds a lot like acme.sh. It integrates with a few DNS providers and is run as a simple cronjob

I tried certbot a few times, but never liked it.

Usually I use acme.sh on VMs and cert-manager on Kubernetes.

You might want to look at another client and dns-01 verification instead of the annoying mess of http-01.

I'm replacing acme.sh with Lego currently. https://go-acme.github.io/lego/

Once you have Cloudflare (or one of many other options) set up it works as easily as you describe. And no port 80 open or special snowflake reverse proxy rules.

I'm aware of it and I'm using it. But I feel uneasy when some software can wreak havoc in my DNS, even if theoretically. For example Cloudflare does not have some kind of very limited "letsencrypt tokens".

That's a different proof of ownership model, though. If I understand it correctly, you set the DNS record once and then forget about it. Hence, you will only prove that you had control over the zone at some point in time. With the DNS-01 challenge you prove that you have control over the zone at the time you request the certificate, because it requires a new TXT record every time.

But what could an attacked actually do in vbezhenar’s proposed protocol? An attacker could… get a new certificate for a private key they don’t have? How is that bad?

Well, you would only need to compromise a dns zone once and sneak in your DNS record. If the actual owner of the domain/zone does not carefully watch their records and if they use a different verification method for their certificates, then you'll have a continously operating backdoor. Maybe this is somewhat fabricated, but if you require a fresh challenge everytime, then that means the attacker has to maintain a compromised channel to the dns zone, which one could argue raises the bar significantly.

A bit far-fetched, but sure. You could require that the certificate put into the DNS record also had, say, today’s date on it (UTC). This way, you’d fix the problem you describe but still have a vastly simpler process than ACME.

You could also just skip the CA part, and use DANE. Just publish the key in your DNS, and the corresponding self-signed certificate in your server.

Are there any DANE compatible clients today?

No. DANE is a dead letter standard.

Reply on news.ycombinator.com