nickblah

6 ms·

1.
by nickblah 4y ago
National Renewable Energy Lab | Full-stack, back-end, or front-end | Golden, CO or Remote | Full-Time | https://www.nrel.gov Hi! My team at the National Renewable Energy Laboratory (NREL) is looking to hire additional web develo
2.
by nickblah 10y ago
Yes, by default the module requires that you explicitly whitelist the domains you want to allow certificate registration for. So while you could allow any domain to be registered, that's not recommended for this precise reason. But the
3.
by nickblah 10y ago
I haven't actually looked into DVSNI in too much detail before, so that could definitely be the case. I'll have to investigate a bit more (or any pull requests are always welcome). Thank you for the tip!
4.
by nickblah 10y ago
Author here. I hadn't really considered it, but it should be possible. Since we're handling this with nginx and Lua, it made it pretty trivial to handle the simple HTTP challenge (since we can easily intercept the /.well-know
5.
by nickblah 10y ago
Yes, as long as you're using a shared storage adapter (like Redis), then for the most part, duplicate registration or renewal requests should be handled. The approach to locking we're using is somewhat simplistic (and the specific
6.
by nickblah 10y ago
I've updated the requirements in the README. Thanks for pointing that out!
7.
by nickblah 10y ago
Author here. Our current approach is perhaps a bit different, since we're not actually parsing the nginx config file, so we don't have knowledge of the domains at startup. Instead, we're relying on the "allow_domain&quot
8.
by nickblah 10y ago
Author here.. If I'm understanding you correctly, I believe that's how things are already working. The very first time a client hits a new domain, the SSL handshake initiates the certificate registration with Let's Encrypt (a
9.
by nickblah 11y ago
If you can use OpenResty (nginx+Lua), then that's exactly the approach I've taken for a plugin I've been developing recently (SNI, on-demand, and caching): https://github.com/GUI/lua-resty-auto-ssl There
10.
by nickblah 11y ago
If you're open to using OpenResty (basically nginx with some additional plugins and Lua integration), I've coincidentally been working on a plugin to make all of this completely automatic with Let's Encrypt (taking advantage