26
Centralized SSL certificate management? (lemmy.dbzer0.com)
submitted 3 months ago by to c/selfhosted@lemmy.world
19 comments fedilink hide all child comments
 

I’m not even sure this title makes sense. I’m looking to handle LE certificates in cloudflare automatically. Specifically multi level subdomains.

You can hand off subdomain certs to them for single level, but the moment you want multi level you need to manage the certs yourself.

What I’m hoping for is an open source/self hosted tool that is meant to handle certificate requests and distribution. I just don’t know if such a tool even exists, and searching around hasn’t yielded results.

Does anyone have any thoughts?

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 3 months ago (5 children)

Why not handle certs on your end and just use CF for proxy? I use NPM for cert automation with CF proxying. It's honestly ridiculous easy and I've had no issues.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] [S] 1 point 3 months ago (4 children)

    Cloudflare doesn’t pass the cert you have through, it generates its own cert (or uses one you provide).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 3 months ago (3 children)

    Depends on your config, I'm just doing DNS (proxied). So you hit my nginx and that's where the cert is provided.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] [S] 1 point 3 months ago (2 children)

    Have you actually confirmed that is the case? My understanding is that cloudflare pretty much always re-signs with their own SSL cert. and I'm fairly certain that would be absolutely required when using their DNS proxies.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 3 months ago (1 child)

    I have confirmed it - it's how I run all my services

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] [S] 1 point 3 months ago

    Yes, it’s also how I run all my services. I checked just this moment, and locally my certs verified by field is Let’s Encrypt, while remotely that field is Google Trust Services

    I have never personally provisioned a cert from Google. I have only ever utilized Let’s Encrypt. That leaves just one involved party that could have requested, received and presented this cert: Cloudflare.

  • permalink
  • fedilink
  • source
  • parent