Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

:) "Just a letsencrypt cert". That's right for me and most off the HN audience. Is it right for the general public?


Which audience exactly is cool with the register a domain name, figure out your ip, setup an A record to point there (maybe dynamically!), enable port forwarding, install a web server, etc, but gets stuck on letsencrypt?

Letsencrypt is almost certainly the easiest part of the entire process of self-hosting a website.


Yes, because if you web server publicly reachable, letencrypt can be automated easily. And there is plenty of letsencrypt software that does fully automates this.

A public web server is the easy part if you want to do letsencrypt.


Letsencrypt is easy, if you are running generic Linux distribution and can easily install whatever you want.

But you might run a device that already comes with software, and letsencrypt support is either limited (example: Synology; their implementation allows only http-01 challenge so if you need dns-01, tough luck. Even wildcards are a new feature) or non-existent (example: Ubiquiti, and their cloud keys (administration UI, guest portal) or routers (Radius/WPA Enterprise needs TLS cert too)).


dns-01 is possible on Synology, but you need to SSH in:

* https://github.com/acmesh-official/acme.sh/wiki/Synology-NAS...

* https://lippertmarkus.com/2020/03/14/synology-le-dns-auto-re...

* http://www.thedreaming.org/2020/11/18/synology-lets-encrypt/

It's possible as long as your ACME client has hook scripts, and your DNS provider has an API:

* https://github.com/AnalogJ/lexicon


It's unofficial, but https://github.com/kchristensen/udm-le lets you provision LetsEncrypt certificates for Ubiquiti kit.


> Is it right for the general public?

My Asus router has a checkbox for dynamic DNS and for getting Let's Encrypt certs. See Method 2:

* https://www.asus.com/us/support/FAQ/1034294/#a2


Is the general public that much into running private web services on their home networks?


Yes. Even the most complex technical setup can be accomplished by a non-technical person that can follow directions assuming that someone took the time to write clear and concise directions and included common caveats and troubles that one may run into and where to check for them. I have proven this many times over by having managers and directors that were non-technical follow my instructions. In the rare moments this breaks down, forums and chat rooms can be a very handy gap-filler and provides an indirect feedback loop to further improve documentation.


The general public's alternative is to buy a cert every year for $$. They'll figure it out. (or their shared hosting provider will)


That is the lowest bar for setting your certificates. It should be right for the general public.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: