acme-dns-server
public-roadmap
acme-dns-server | public-roadmap | |
---|---|---|
2 | 5 | |
29 | 37 | |
- | - | |
1.8 | 0.0 | |
almost 2 years ago | 11 months ago | |
Python | ||
MIT License | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
acme-dns-server
-
Ask HN: What's your solution for SSL on internal servers?
DNS alias mode:
* https://dan.langille.org/2019/02/01/acme-domain-alias-mode/
* https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo...
* https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...
You want the name "internal.example.com". In your external DNS you create a CNAME from "_acme-challenge.internal.example.com" and point it to (e.g.) "internal.example.net" or "internal.dns-auth.example.com"
When you request the certificate you specify the "dns-01" method. The issuer (e.g., LE) will go to the the external DNS server for the look up, see that it is a CNAME and then follow the CNAME/alias, and do the verification at the final hostname.
So your ACME client has to do a DNS (TXT) record update, which can often be done via various APIs, e.g.:
* https://github.com/AnalogJ/lexicon
You can even run your own DNS server locally (in a DMZ?) if your DNS provider does not have an convenient API. There are servers written for this use case:
* https://github.com/joohoi/acme-dns
* https://github.com/joohoi/acme-dns-certbot-joohoi
* https://github.com/pawitp/acme-dns-server
-
Another free CA as an alternative to Let's Encrypt
I already had Bind on the machine so it was logical to add the zone there and utilize nsupdate : https://gist.github.com/kronthto/893715f12cc0b1cda9fcfdbd8dc...
But what you are suggesting should work just fine aswell - there should be no need for a persistent service. Of course the service would need to run on port 53, so you actually cannot have another nameserver on that machine already, and also require CAP_NET_BIND_SERVICE .
A quick search lead me to this python project that could be an inspiration: https://github.com/pawitp/acme-dns-server
public-roadmap
-
Another free CA as an alternative to Let's Encrypt
We use Caddy for serving our free dashboards and status pages on your own domain at https://checklyhq.com
It was not super easy to set up. I think the whole config is 20 lines or so, but the docs, naming and functionality of how Caddy actually interfaces with LE was tricky to find out. Basically had to scrape together answers from various GitHub issues etc.
I should write a blog post…
- Node.js 16 Available Now
-
Web based testing environments for the Puppeteer
Have you given checklyhq.com a look? Sounds like it could be a great fit. (Disclaimer: I work there).
-
Polling an API or MYSQL query to do alerting and monitoring?
Have a look at https://checklyhq.com. We do exactly that, API monitoring. You can set up a check that parses your API response and validates a specific field. We also have a free plan. Disclaimer: I’m the CTO.
-
Monitoring with Playwright on Checkly made easy
We're looking forward to how Checkly will make their monitoring solution even more accessible for developers with e.g. versioned code, an integrated Monaco editor with better auto-completion, support for custom NPM modules, or a better debugging experience. We would recommend giving it a try and have not to worry about where to run your status checks or end-to-end tests and benefit from their simplicity. For a more detailed outlook, they provide an official public roadmap on GitHub.
What are some alternatives?
acme-dns - Limited DNS server with RESTful HTTP API to handle ACME DNS challenges easily and securely.
acme-tiny - A tiny script to issue and renew TLS certs from Let's Encrypt
dehydrated - letsencrypt/acme client implemented as a shell-script – just add water
proposal-regexp-match-indices - ECMAScript RegExp Match Indices
acme-dns-certbot-joohoi - Certbot client hook for acme-dns
lego - Let's Encrypt/ACME client and library written in Go
letsencrypt - Certbot is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server. It can also act as a client for any other CA that uses the ACME protocol.
mkcert - A simple zero-config tool to make locally trusted development certificates with any names you'd like.
iswasmfast - Performance comparison of WebAssembly, C++ Addon, and native implementations of various algorithms in Node.js.