devcert
acme-dns
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
devcert
-
A safer default for navigation: HTTPS
The devcert tool (and its corresponding devcert-cli command-line interface) is very handy for creating a local root certificate authority that you control & your device trusts:
https://github.com/davewasmer/devcert
acme-dns
-
Migrating Mess with DNS to Use PowerDNS
Great question. My first pass at the project was looking to conform to the ACME DNS API [1]. There are some tools for cert management that use that API, so it gave me broad tool support with very little effort. The getlocalcert subdomains don't permit user modification of A, MX, or CNAME records on the public DNS; you've got to do that with a private DNS server you provide.
I may consider extending the service to allow A/AAAA records to private IP ranges, and then I'd need a more full featured API, but this far there hasn't been demand for the feature.
Hit me up on email if you want to chat more (in profile), we're solving some similar problems.
[1] https://github.com/joohoi/acme-dns
-
Free DDNS with Cloudflare and a Cronjob
there is also https://github.com/joohoi/acme-dns and LE clients like lego supporting it.
-
Subdomain.center – discover all subdomains for a domain
Getting a wildcard certificate from LE might be a better option, depending on how easy the extra bit of if plumbing is with your lab setup.
You need to use DNS based domain identification, and once you have a cert distribute it to all your services. The former can be automated using various common tools (look at https://github.com/joohoi/acme-dns, self-hosted unless you are only securing toys you don't really care about, if you self host DNS or your registrar doesn't have useful API access) or you can leave that as an every ~ten weeks manual job, the latter involves scripts to update you various services when a new certificate is available (either pushing from where you receive the certificate or picking up from elsewhere). I have a little VM that holds the couple of wildcard certificates (renewing them via DNS01 and acmedns on a separate machine so this one is impossible to see from the outside world), it pushes the new key and certificate out to other hosts (simple SSH to copy over then restart nginx/Apache/other).
Of course you may decide that the shin if your own CA is easier than setting all this up, as you can sign long lived certificates for yourself. I prefer this because I don't need to switch to something else if I decide to give friends/others access to something.
- Easy HTTPS for your private networks
-
I've created a solution for managing internal domains, how do I selfhost this more?
As someone else said, it’s a huge pain to run your own dns services. However, if you want some separation, I recently saw https://github.com/joohoi/acme-dns
-
LeGo CertHub v0.9.0 with Docker Support
v0.9.1 is out and natively supports both https://github.com/joohoi/acme-dns and any dns provider available in https://github.com/acmesh-official/acme.sh
-
How do you deal with SSL certs management?
I have set up an acme-dns server to answer ACME DNS Challenges: https://github.com/joohoi/acme-dns
- How to configure and use acme-dns?
-
What is a good alternative if port 80 is blocked?
The DNS challenge can be easily automated using https://github.com/joohoi/acme-dns - you do need an IP you can run a DNS server on though.
-
Setting up ssl on AGH
If your server is not accessible over the internet, you can still use Let's Encrypt or ZeroSSL to get a certificate. You'll just need to set up a DNS Challenge for things to work. This is a little more complicated, but can work even if your DNS provider doesn't have an API. For example, I use Google Domains and Google DNS (not cloud DNS) for my DNS server, but I've got an instance of acme-dns running on VPS box that handles the DNS auth for me. It's how every machine on my local network has valid certificates - but I annoyingly need to renew them every 90 days.
What are some alternatives?
web.dev - The frontend, backend, and content source code for web.dev
Nginx Proxy Manager - Docker container for managing Nginx proxy hosts with a simple, powerful interface
mkcert - A simple zero-config tool to make locally trusted development certificates with any names you'd like.
lego - Let's Encrypt/ACME client and library written in Go
ecs-fargate-ci-cd-pipeline - Repository from exanubes.com for Fargate App with a SSL Certificate
duckdns - Caddy module: dns.providers.duckdns
cert-gen - Generate CA and self-signed SSL certificates usable in your browser for local development.
acme-dns-server - Simple DNS server for serving TXT records written in Python
servercert - Repository for the CA/Browser Forum Server Certificate Chartered Working Group
dehydrated - letsencrypt/acme client implemented as a shell-script – just add water
vite-plugin-proxy-page - A Vite plugin for projecting your application onto a remote page during development.
acme.sh - A pure Unix shell script implementing ACME client protocol