this post was submitted on 04 Apr 2025
876 points (99.2% liked)
Programmer Humor
22232 readers
601 users here now
Welcome to Programmer Humor!
This is a place where you can post jokes, memes, humor, etc. related to programming!
For sharing awful code theres also Programming Horror.
Rules
- Keep content in english
- No advertisements
- Posts must be related to programming or programmer topics
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
so the other day I sat down trying to setup a SSL cert for my self-hosted services
Have you heard of our Lord and Savior, Traefik + ACME issuers?
Let's encrypt brother
Let's Encrypt Expiry Bot just entered the chat.
Does Trafik also allow DNS based challenges with additional certbot plugins, or does it only work by serving a challenge in /.well-known/?
I’ve set up my internal homelab with LE certificates, but if I could get rid of certbot and do this automagically, it’d be nice…
I have it setup to use DNS challenges through Cloudflare, but it supports different providers as well. I just add the labels to my docker container and voila, I have TLS
Not all dns providers support acme, I've discovered to my recent annoyance. The one I use at work, for instance.
I already use certbot with my DNS provider, so it should generally be supported. And indeed, O found the docs, where all supported providers are listed.
https://doc.traefik.io/traefik/https/acme/#providers
Yeah. For wildcard DNS from letsencrypt, you can't do HTTP validation, only DNS, which involves creating a TXT record.
Your DNS provider needs to run an ACME server, which runs an API that'll add the required TXT records on request.
As I understand it.
The DNS provider needs to provide an API, but not an ACME server.
Your server contacts Lets Encrypt and wants a certificate - say for homeserver.example.com. It tells Let's Encrypt to use DNS based authentication. Let's encrypt answers with a challenge code, that you now publish as a txt record with a defined name via your providers API for this (sub)domain. Let's encrypt then checks the TXT record and if it finds the challenge there, it sends you the certificate.
Might want to check out swag from linuxserver.io
It's a docker/kubernetes container image with a working certbot client in it.