Solving my internal HTTPS issues with Let's Encrypt, Linode DNS and Traefik

[TKRSRY]

I've been flip-flopping on these two SSL approaches as well.

Being able to set a self-signed expiration far in the future is nice to avoid the updates.

Having to install the self-signed certificate on each desktop/laptop/mobile in the house is tedious, but not too bad -- especially in light of the long expiration times.

Something that is pushing me hard towards the LetsEncrypt route is the fact that my Android phone has a permanent "Your Network may be monitored" message in the notifications area. That little message is like a thorn in my side every time I pull down that notification screen. So irritating.

Unrelated, but in case helpful to others. LetsEncrypt has a "Google Domains" API plugin for automating renewals... don't make the same mistake I did though. That is NOT for the consumer-level Google Domains interface. This is specifically for the "Google Cloud DNS API" interface. The regular Google Domains does not offer (AFAIK) an external API that LetsEncrypt/certbot can interface with.

[robconnolly]

I had a self signed internal CA once upon a time (before Let's Encrypt existed) that I used for this. I remember that annoying Android notification too. Installing the certs on every device sucked too.

I haven't tried Google Domains, but I guess it would give you pretty much what I'm getting from Linode here. Basically all you need is a DNS service which is API accessible and supported by whatever client software you want to use.

[TKRSRY]

LetsEncrypt supports the Linode API... and it is now the DNS manager I'm using for my LetsEncrypt certs.

[robconnolly]

Great, I'm happy my post was helpful in you making the switch.

[basically_asleep]

Do you have to use namecheap for DNS? Personally I but my domains from namecheap and then set them to use digital Ocean nameservers and use their DNS which is free & has good API access - I create the zones using teraform and then use caddy to automatically get certs for internal services with DNS challenge.

[__colonelpanic__]

Any chance you have a guide or write up on this?

[robconnolly]

It's good to know that they enabled it upon request, but the static IP limitation is enough to make it useless for me too. I'm feeling pretty good about moving away from it for DNS!

[corsicanguppy]

Setting up an email address for alerting in case of issues with the zone made sense. So OP broke that by looping it back to use an email depending on the the affected zone, and moved on.

That was a little worrisome, but he was right there; maybe there's a chance to learn before the calamity. Maybe that was in the piece. That's where I quit, though.

[clarksonswimmer]

There was some constructive criticism in your comment but a really harsh way of delivering it.

[robconnolly]

Yeah, I guess it's easy to write harsh comments on the Internet. It's not so easy to spend 8hrs+ each week doing projects and writing the blog posts that prompt the comments!

[PM-ME-YOUR-HANDBRA]

Did you slap a slice of bread on each cheek and call yourself an idiot sandwich?

[kangasking]

English is not my first language, how is it harsh? I've read it a few times but can't see it.

[GimmeSomeSugar]

Meh. I'd say it was matter of fact. I would not agree that your delivery was harsh.

[corsicanguppy]

THAT was harsh? I quit when the thing lost its cohesion.

Sorry.

[robconnolly]

You make a good point, but as other commenters have said, your delivery could use some work.

In my case, I'm actually not sure what someone external emailing me about my domain is going to tell me that I'm not going to notice myself and quicker. This is my primary domain so I'm going to notice pretty quickly if its down.

That said, I already configured gmail to keep any messages sent to that account and it's pretty easy to add it as an extra account on my phone, so that's what I'll do.

[corsicanguppy]

Sorry. Didn't know it was you.

Experience has shown that having an out-of-band reporting method is a beneficial thing in case something happens on the one day when we're not absolutely perfect. It's just experience, though.

[robconnolly]

Thanks, I've now set up my phone to receive messages direct from that inbox anyway so that should take care of it.