Med-Mastodon

Harald<a href="https://fedi.arkadi.one/@tootbrute" class="u-url mention" rel="nofollow noopener" target="_blank">@tootbrute</a> <a href="https://c.im/@sbb" class="u-url mention" rel="nofollow noopener" target="_blank">@sbb</a> In case you are interested how I solved having a publicly signed SSL certificate for a home server not connected to the Internet, here is what I did:<a href="https://codeberg.org/harald/Codeschnipselnotizen/src/branch/main/notes/Public_Cert_In_Home_Network.md" rel="nofollow noopener" translate="no" target="_blank">https://codeberg.org/harald/Codeschnipselnotizen/src/branch/main/notes/Public_Cert_In_Home_Network.md</a>The downside: there seems to be no way without having a registered domain. It took me unnecessary time to accept this. The upside: taking the step to get yourself a domain is simpler and cheaper than I was aware of and with the right tool, the rest was easy enough.<a href="https://nrw.social/tags/dns" class="mention hashtag" rel="nofollow noopener" target="_blank">#dns</a> <a href="https://nrw.social/tags/homeserver" class="mention hashtag" rel="nofollow noopener" target="_blank">#homeserver</a> <a href="https://nrw.social/tags/acmesh" class="mention hashtag" rel="nofollow noopener" target="_blank">#acmesh</a> <a href="https://nrw.social/tags/letsencrypt" class="mention hashtag" rel="nofollow noopener" target="_blank">#letsencrypt</a>

DrScripttI started a discussion with fellow <a href="https://oldbytes.space/tags/sysadmin" class="mention hashtag" rel="nofollow noopener" target="_blank">#sysadmin</a> about updating <a href="https://oldbytes.space/tags/BIND" class="mention hashtag" rel="nofollow noopener" target="_blank">#BIND</a> / <a href="https://oldbytes.space/tags/named" class="mention hashtag" rel="nofollow noopener" target="_blank">#named</a> config to migrate from the overly permissive allow-update {…} stanzas to the more restricted update-policy {…} stanzas using targeted grant statements.The idea being to allow the <a href="https://oldbytes.space/tags/acme" class="mention hashtag" rel="nofollow noopener" target="_blank">#acme</a> client to only be able to update (add / delete) _acme-challenge TXT instead of any record in the zone.Old:allow-update { TSIG_KEY_NAME; };New:update-policy { grant TSIG_KEY_NAME name _acme-challenge.example.net TXT; };<a href="https://oldbytes.space/tags/acmesh" class="mention hashtag" rel="nofollow noopener" target="_blank">#acmesh</a> <a href="https://oldbytes.space/tags/certbot" class="mention hashtag" rel="nofollow noopener" target="_blank">#certbot</a>

Olivier MehaniNew blog post: Renew DNS-01 Let’s Encrypt certificates with Acme.sh, Docker, SaltStack and Gandi LiveDNSThe HTTP-based challenge to issue LetsEncrypt certificates can’t be used for internal or non-HTTP servers. This post describes the use of acme.sh in Docker to issue and renew certificates over DNS via SaltStack.<a href="https://blog.narf.ssji.net/2024/09/30/renew-dns-01-lets-encrypt-certificates-with-acme-sh-docker-saltstack-and-gandi-livedns/" class="" rel="nofollow noopener" target="_blank">https://blog.narf.ssji.net/2024/09/30/renew-dns-01-lets-encrypt-certificates-with-acme-sh-docker-saltstack-and-gandi-livedns/</a><a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/acme-sh/" target="_blank">#AcmeSh</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/docker/" target="_blank">#Docker</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/gandi-livedns/" target="_blank">#GandiLiveDNS</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/lets-encrypt/" target="_blank">#LetSEncrypt</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/pgp/" target="_blank">#PGP</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/saltstack/" target="_blank">#SaltStack</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/category/engineering/" target="_blank">#engineering</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/category/security/" target="_blank">#security</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/category/sysadmin/" target="_blank">#sysadmin</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/category/tip/" target="_blank">#tip</a>

Thijs AlkemadeA Chinese CA was exploiting a command injection in a shell script implementing the ACME protocol, and they are now taking everything down? What?!I can’t find if this CA was actually trusted by any browser, though.<a href="https://github.com/acmesh-official/acme.sh/issues/4659" rel="nofollow noopener" target="_blank">https://github.com/acmesh-official/acme.sh/issues/4659</a><a href="https://infosec.exchange/tags/acmesh" class="mention hashtag" rel="nofollow noopener" target="_blank">#acmesh</a> <a href="https://infosec.exchange/tags/hica" class="mention hashtag" rel="nofollow noopener" target="_blank">#hica</a>

Olivier MehaniNew blog post: Renewn DNS-01 Let’s Encrypt certificates with Acme.sh, Docker, SaltStack and Gandi LiveDNSThe HTTP-based challenge to issue LetsEncrypt certificates can’t be used for internal or non-HTTP servers. This post describes the use of acme.sh in Docker to issue and renew certificates over DNS via SaltStack.<a href="https://blog.narf.ssji.net/2022/10/28/renewn-dns-01-lets-encrypt-certificates-with-acme-sh-docker-saltstack-and-gandi-livedns/" class="" rel="nofollow noopener" target="_blank">https://blog.narf.ssji.net/2022/10/28/renewn-dns-01-lets-encrypt-certificates-with-acme-sh-docker-saltstack-and-gandi-livedns/</a><a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/acme-sh/" target="_blank">#AcmeSh</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/docker/" target="_blank">#Docker</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/gandi-livedns/" target="_blank">#GandiLiveDNS</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/lets-encrypt/" target="_blank">#LetSEncrypt</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/pgp/" target="_blank">#PGP</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/saltstack/" target="_blank">#SaltStack</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/wip/" target="_blank">#wip</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/category/engineering/" target="_blank">#engineering</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/category/security/" target="_blank">#security</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/category/sysadmin/" target="_blank">#sysadmin</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/category/tip/" target="_blank">#tip</a>

Olivier MehaniNew blog post: Renew DNS-01 Let’s Encrypt certificates with Acme.sh, Docker, SaltStack and Gandi LiveDNSThe HTTP-based challenge to issue LetsEncrypt certificates can’t be used for internal or non-HTTP servers. This post describes the use of acme.sh in Docker to issue and renew certificates over DNS via SaltStack.<a href="https://blog.narf.ssji.net/2022/10/28/renew-dns-01-lets-encrypt-certificates-with-acme-sh-docker-saltstack-and-gandi-livedns/" class="" rel="nofollow noopener" target="_blank">https://blog.narf.ssji.net/2022/10/28/renew-dns-01-lets-encrypt-certificates-with-acme-sh-docker-saltstack-and-gandi-livedns/</a><a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/acme-sh/" target="_blank">#AcmeSh</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/docker/" target="_blank">#Docker</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/gandi-livedns/" target="_blank">#GandiLiveDNS</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/lets-encrypt/" target="_blank">#LetSEncrypt</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/pgp/" target="_blank">#PGP</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/saltstack/" target="_blank">#SaltStack</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/tag/wip/" target="_blank">#wip</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/category/engineering/" target="_blank">#engineering</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/category/security/" target="_blank">#security</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/category/sysadmin/" target="_blank">#sysadmin</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://blog.narf.ssji.net/category/tip/" target="_blank">#tip</a>

Recent searches

Search options

Administered by:

Server stats:

#acmesh