Comments (3)
Perhaps the certificates—and private keys, for that matter—could be stored in AWS Systems Manager Parameter Store or whatever the equivalent service is for Azure/Google Cloud.
from micronaut-acme.
Please post questions in StackOverflow.
You can also try with asking in Gitter.
from micronaut-acme.
@RyanHoldren I missed this originally sorry about that..... the way it works right now is each server would end up requesting a new certificate which should work with in theory with no issues. Assuming you are using Lets Encrypt you can see previous responses here about doing so but main issues with this approach are 2 things. 1. would be rate limiting and 2. would be the authorizations process. (https://community.letsencrypt.org/t/aws-distributing-current-certbot-certificates-amongst-server-which-are-spun-up-with-autoscale/35739/2). So in theory you could randomize the acme.renew-within
property to have them renew on different intervals to skirt the ratelimiting if you have that many servers.
But to the issue of the authorization step that would have issues if you selected http/tls since those would need to get directed to whichever server actually made the call since there is a token involved at the time of order. There is a chance it could work but unlikely due to you more than likely having a load balancer in place.
That leaves you with DNS being you only option but ATM DNS option requires manual intervention until #3 #4 #5 (or whatever DNS provider you are using that might have an API) are done and it just happens automatically.
And maybe there are other routing options or fanciness you could do to get the authorizations to work out.... id be curious to hear more about how you have certbot running on multiple servers requesting renewals or maybe you dont and you just have a "master certbot server" that does all the magic and then NFS to share the cert.
Also as far as storing the certificate in AWS Systems Manager Parameter Store or whatever the equivalent service is for Azure/Google Cloud. Not sure it solves the issue. The biggest hangup i think is the authorization process. But maybe again you just have 1 node do it, share to a storage provider and then all the other nodes check for changes on an interval. ¯_(ツ)_/¯ #spitballin. But now you're down to 1 node and no redundancy.
from micronaut-acme.
Related Issues (20)
- Micronaut Starter doesn't support create-key command HOT 9
- Release a new version compatible with Micronaut 3.0 HOT 1
- Build fails with JDK 16 HOT 6
- Graal Native Image build of project created with Micronaut Launch fails HOT 13
- `mn create-acme-account` help output misleading about existing keys HOT 3
- Intermediate cert not being sent HOT 7
- Enable deployment without the `mn create-acme-account` command (documentation or new CLI tool)
- ACME module throws exception when used with Oracle Cloud ATP Datasource HOT 2
- Update Micronaut acme build to newest infrastructure
- Exception with 3.1.1.SNAPSHOT HOT 2
- Dependency Dashboard
- Migrate to new configuration ascidoc macro
- Documentation specifies version when it is not necessary HOT 1
- Del @Deprecated ACME HOT 1
- Create Release History section to Micronaut acme docs HOT 1
- Add a repository section to micronaut-acme docs
- CertificateEvent should contain cert chain HOT 3
- [Bug] Challenge starts to soon using dns challenge
- [2.0.1.snapshot]download fails HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from micronaut-acme.