I’ve been downloading SSL certificates from my domain provider, using cat to join them together to make the fullchain.pem, uploading them to the server, and myself adding a 90 day calendar reminder. Every time I did this I’d think I should find out about this Certbot thing.
Well, I finally got around to it, and it was one of those jobs which turns out to be so easy you wish you’d done it ages ago.
The install was simple (I’m using nginx/ubuntu).
It scans up your server conf files to see which sites are being served, asks you a couple of questions, obtains the Let’s Encrypt certificate for them, installs it, updates your conf files to use it, and sets up a cron job to check if it’s time to renew the certificate, which it will also do auto-magically.
I was so pleased with it I made a donation to the EFF for it, then I started to think about how amazingly useful Let’s Encrypt is, and gave them one too. It’s just a really good time to be in this hobby.
I highly recommend Certbot. If you’ve been putting this off, or only just hearing about it, make some time for it.
Downloading certificates from your domain provider is often a security problem. Only you are supposed to know your private keys.
Good point. Although they are also hosting my DNS, so they can take the site over anytime they want anyway?
They could hijack your site at any time, but with a copy of your live private certs they (or more likely whatever third party that will invariably breach your domain provider) can decrypt your otherwise secure traffic.
I don’t think there’s significant real tangible risk since who cares about your private selfhosted services and I’d be more worried about the domain being hijacked, and really any sort of network breach is probably interested in finding delicious credit card numbers and passwords and crypto private keys to munch on. If someone got into my network, spying on my Jellyfin streaming isn’t what I’m going to be worried about.
But it is why CSRs are used.
I took a look at Traefik once and the complexity scared me away. Caddy is my cup of tea with one simple config file.
Certbot is great when using Nginx (or Apache2), but if you can use a different engine. Its worthwhile checking out Caddy!
Wait till you guys use cert-manager on a kubernetes cluster
Wait until you stand up your own CA and issue certs with multi-year validity so they don’t have to be renewed more often than you rebuild everything anyway
At least until you try to access stuff on a Pixel phone which doesn’t let you install CA certs any more 😞
Having certificates that are valid for over a year is contra-productive, as when they get in to the wrong hands they might still be valid for a year until they naturally run out of time. The reason LetsEncrypt issues only 90d valid certificates is not to annoy you, but save your ass once someone obtains your certificates.
I had no problem to install my CA on my Pixel (Android 13). I read that this was not possible for some time but Google changed it.
Is it possible to change the elliptic curve yet or does it still throw suspicious errors
