acme-tiny
acme-dns-server
Our great sponsors
| acme-tiny | acme-dns-server | |
|---|---|---|
| 5 | 2 | |
| 4,699 | 29 | |
| - | - | |
| 0.0 | 1.8 | |
| over 1 year ago | over 1 year ago | |
| Python | Python | |
| MIT License | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
acme-tiny
- Write Posix Shell
-
ZeroSSL: XSS to session hijacking, stealing a private key (and password hash)
Going to throw another hat into the ring here: I use acme-tiny [1], which is a single file ACME client written in Python in under 200 lines. The idea behind it is that you can fully read and understand everything it does without spending too much time on it. I really like this approach, so I went ahead and started using it, and have been for a few years now.
- Uacme: ACMEv2 client written in plain C with minimal dependencies
-
Certs for SSL for internal devices
Let’s Encrypt with ACME-Tiny
-
Another free CA as an alternative to Let's Encrypt
Recommendation from me as well. Have been using this script for multiple years now without a single issue. The minimal code is awesome for avoiding unnecessary external dependencies and complexity.
Be sure to use the latest version from https://github.com/diafygi/acme-tiny though :-)
acme-dns-server
-
Ask HN: What's your solution for SSL on internal servers?
DNS alias mode:
* https://dan.langille.org/2019/02/01/acme-domain-alias-mode/
* https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo...
* https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...
You want the name "internal.example.com". In your external DNS you create a CNAME from "_acme-challenge.internal.example.com" and point it to (e.g.) "internal.example.net" or "internal.dns-auth.example.com"
When you request the certificate you specify the "dns-01" method. The issuer (e.g., LE) will go to the the external DNS server for the look up, see that it is a CNAME and then follow the CNAME/alias, and do the verification at the final hostname.
So your ACME client has to do a DNS (TXT) record update, which can often be done via various APIs, e.g.:
* https://github.com/AnalogJ/lexicon
You can even run your own DNS server locally (in a DMZ?) if your DNS provider does not have an convenient API. There are servers written for this use case:
* https://github.com/joohoi/acme-dns
-
Another free CA as an alternative to Let's Encrypt
I already had Bind on the machine so it was logical to add the zone there and utilize nsupdate : https://gist.github.com/kronthto/893715f12cc0b1cda9fcfdbd8dc...
But what you are suggesting should work just fine aswell - there should be no need for a persistent service. Of course the service would need to run on port 53, so you actually cannot have another nameserver on that machine already, and also require CAP_NET_BIND_SERVICE .
A quick search lead me to this python project that could be an inspiration: https://github.com/pawitp/acme-dns-server
What are some alternatives?
acme.sh - A pure Unix shell script implementing ACME client protocol
acme-dns - Limited DNS server with RESTful HTTP API to handle ACME DNS challenges easily and securely.
letsencrypt - Certbot is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server. It can also act as a client for any other CA that uses the ACME protocol.
dehydrated - letsencrypt/acme client implemented as a shell-script – just add water
acme-dns-certbot-joohoi - Certbot client hook for acme-dns
lego - Let's Encrypt/ACME client and library written in Go
dehydrated-bigip-ansible - Ansible based hooks for dehydrated to enable ACME certificate automation for F5 BIG-IP systems
mkcert - A simple zero-config tool to make locally trusted development certificates with any names you'd like.
public-roadmap - Checkly public roadmap. All planned features, updates and tweaks.