Hacker News Reader

Comment by trothamel | Hacker News Reader

Question: Does anyone have a good solution for renewing letsencrypt certificates for websites hosted on multiple servers? Right now, I have one master server that the others forward the well-known requests too, and then I copy the certificate over when I'm done, but I'm wondering if there's a better way.

View on HN

I use DNS verification for this then the server doesn't even need to be exposed to the internet.

And if changing the DNS entry is problematic, for example the DNS provider used doesn't have an API, you can redirect the challenge to another (sub)domain which can be hosted by a provider that has an API.

I've done this and it works very well. I had a Digital Ocean droplet so used their DNS service for the challenge domain.

https://letsencrypt.org/docs/challenge-types/#dns-01-challen...

I use dns01 in my homelab with step-ca. works like a charm, and it's my private certificate authority

We just use certbot on each server. Are you worried about the rate limit? LE rate limits based on the list of domains. So we send the request for the shared domain and the domain for each server instance. That makes each renew request unique per server for the purpose of the rate limit.

Orchestrate the renewal with Ansible - renew on the "master" server remotely but pull the new key material to your orchestrator and then push them to your server fleet. That's what I do. It's not "clean" or "ideal" to my tastes, but it works.

It also occurred to me that there's nothing(?) preventing you from concurrently having n valid certificates for a particular hostname, so you could just enroll distinct certificates for each host. Provided the validation could be handled somehow.

The other option would maybe be doing DNS-based validation from a single orchestrator and then pushing that result onto the entire fleet.

There's a tool called "lsyncd" which watches for a file and syncs the changed file to other servers "within seconds".

I use this to sync users between small, experimental cluster nodes.

Some notes I have taken: https://notes.bayindirh.io/notes/System+Administration/Synci...

Have you tried certbot? Or if you want a turnkey solution, you may try Caddy or Traefik that have their own automated certificate generation utility.

getssl was written with a bit of a focus on this:

> Get certificates for remote servers - The tokens used to provide validation of domain ownership, and the certificates themselves can be automatically copied to remote servers (via ssh, sftp or ftp for tokens). The script doesn't need to run on the server itself. This can be useful if you don't have access to run such scripts on the server itself, e.g. if it's a shared server.

* https://github.com/srvrco/getssl

DNS verification.

Reply on news.ycombinator.com