That's why we built Relay: a free, browser-based tool that streamlines the ACME workflow, especially for tricky setups like homelabs. Relay acts as a secure intermediary between your ACME client and public certificate authorities like Let's Encrypt.
Some ways Relay provides a better experience:
- really fast, streamlined certificates in minutes, with any ACME client
- one-time upfront DNS delegation without inbound traffic or DNS credentials sprinkled everywhere
- clear insights into the whole ACME process and renewal reminders
Or read our blog post: https://anchor.dev/blog/lets-get-your-homelab-https-certifie...
Please give it a try (it only takes a couple minutes) and let me know what you think.
I see organisations with thousands of SSL certificates, and their struggle is real. Even reputable companies with huge teams have their certificates expire or served badly. Some serve expired certificates for years!
Plus, enterprise alternatives are extremely costly and rigid.
* If you want an SSL certificate for, say, your printer
* And you don’t want to expose your printer’s port 80 to the public internet because you’re not stupid
* And you don’t want to put your DNS credentials onto your printer either, because again, you’re not stupid
* And you don’t want to pay for a certificate with a longer validity, because it’s a home printer, so you’re stitch with monthly cert rotations
* And you’ve embraced the reality that one can delegate SSL not just to CAs, but also to other third parties. Usually the likes of AWS & cloudflare - but why stop there?
Then this product is what you need!
Ummmm why does my printer need a certificate?
https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...
Setup and forget is never good for security. From what I see with sslboard.com (I'm the founder), all hosts serving old expired certificates also have bad TLS versions and ciphers (RC4, DES) and vulnerabilities.
Where is this? Why would bad encryption be better than plaintext? I can't imagine a scenario where this is the case.
This is strictly better than plaintext as a passive eavesdropper cannot listen in; an active attack is needed.
I wrote much more here: https://alexsci.com/blog/is-email-confidential-in-transit-ye...
The browser limits on maximum certificate lifetimes only apply to the public web PKI, not to CAs that you configure yourself.
When creating your CA certificate you can hop into the Advanced tab and add the following line to constrain it to specific domains. This eliminates the risk of your likely-poorly-secured CA being abused to MITM all of your communications:
nameConstraints=critical,permitted;DNS:.home.internal
myawesomedomain.com {
respond "You just loaded this on https"
}
a) impersonate the identities of your users and b) decrypt the SSL traffic of your users
?
Anchor never see sees your private keys for certificates.
We hold an ACME account key on your behalf with the CA, but we cannot use it impersonate your domain or decrypt traffic.
We have a more technical overview of how this works in our docs: https://anchor.dev/docs/public-certs/acme-relay
That makes no sense whatsoever. If you have an ACME account key for my domain, of course you can use it to impersonate my domain. You just need to create another certificate. (Which I could detect, but if I know how to do that, I'm probably not going to need your service anyway.)
1. Install acme-dns somewhere
2. Point part of your domain to that
3. Use lego or caddy or whatever to get certs using dns-01
No need to pay some dude who can then forge certs for your domain.
I'm sorry. But do you really need to re-invent the wheel yet again ?
Go to the Let's Encrypt website, there is a whole page of client implementations[1].
What makes yours better than, for example, `lego` or `caddy` or `step` ?
All of which are easy to use, come with sensible defaults and do not provide you with "innumerable ways to shoot yourself in the foot".
And for people who really can't use Let's Encrypt because "its difficult", there are still all the old-school, well-established, commercial CA's out there who will hold your hand in return for a few dollars.
The point of acme-dns is for people who 1) need to use DNS validation because they don't have an externally accessible web server or need a wildcard cert and 2) either use DNS providers that don't provide API support or whose API support has not been integrated into their tool of choice like cert-manager or certbot.
I have had to use ACME-DNS for that reason, and I don't think it is a horrible business to try to offer that as a service. I don't think I would use it (since acme-dns isn't that hard to set up and I am familiar with it), but I could imagine other people might want to.
ACME is great and it's certainly an improvement over the legacy CA alternatives. But there's also some rough edges that we think can be streamlined.