crlite VS certmagic

> Bloom filters are probabilistic data structures with an error rate due to data collisions. However, if you know the whole range of data that might be tested against the filter, you can compute all the false positives and build another layer to resolve those. Then you keep going until there are no more false positives. In practice, this happens in 25 to 30 layers, which results in substantial compression.

[0] https://github.com/mozilla/crlite/wiki#why-is-crlite-able-to...

Now, I serve TLS directly from the application and was able to make it all work with Certmagic.

For deployment, you may not need a reverse proxy with Nginx or the likes. Certmagic will make HTTPS a breeze. Also makes it possible to handle multi-tenant SaaS domains SSL provisioning. While not the easiest, it was much easier than trying to do it at the reverse proxy and cheaper than doing it with Cloudflare's SaaS service.

If you don't want to move certificate management to a different service, use CertMagic in your app.

With certmagic its done completly automatic using letsencrypt: https://github.com/caddyserver/certmagic

The project is also a boon for devs. The certmagic library0 makes it trivial to add Let's Encrypt support to any Golang web server code.

Because Lego maintainers wouldn't budge when Caddy needed changes made to increase ACME reliability. Matt wrote his own implementation https://github.com/mholt/acmez and started using that in Caddy soon after. There's a deeper explanation here: https://github.com/caddyserver/certmagic/issues/71

That said, I would use https://github.com/caddyserver/certmagic to manage you SSL certs.

I terminate SSL in GO (less moving parts to manage), and use https://github.com/caddyserver/certmagic to provision and renew my certs.