Selfhosted

Good on you. For anyone else inspired, you can support Certbot here, and Let's Encrypt here.

I promise I don't work for them - I was just struck by how phenomenally handy they are.

This is what I use because fuck snap. I used certbot to do wild card certs but once they went to snap I quit.

I also use acme.sh. It has worked great for me and was dead simple to use. Super flexible on what it can do from just renewing the certs to web server integration. Love the simple to use hooks available too.

Thanks, I do, and I've added a couple from the suggestions here. Caddy and Traefik are both on my list of things to investigate now.

Traefik sounds interesting. I'm old-school so I still configure Nginx manually. I've got a bunch of snippets in /etc/nginx/snippets/ so a lot of the configuration is just importing the right snippets.

On the other hand, there's value in using the same software for both reverse proxies and regular websites. There's only one configuration language to learn. I've been using Nginx for over 10 years so I'm very familiar with configuring it.

Wait till you guys use cert-manager on a kubernetes cluster

Use DNS verification and wildcard certs and all this goes away.

In theory you could generate a wildcard to a domain then use it.

My use case is for domains hosted on a VPS rather than my home server-hosted stuff. None of that is exposed to the internet except via Tailnet. I've got a domain saved up for that but haven't figured it out how to do it since the CA can't access my server to verify it. I have the feeling the answer is going to be ten more commenters telling me to check out Caddy.

It's easy* to setup Hashicorp Vault with your own CA and do automated cert generation and rotation, if you are willing to integrate everything into Vault and install your root CA everywhere. (*not really harder than any other Vault setup, but yaknow). I may go down this route eventually since I don't think a device I don't control has ever accessed anything I selfhost, or ever will.

I have a wildcard subdomain pointing to my public IP, and forward port 80 to an LXC container with certbot. Port 80 appears closed outside the brief window when certbot is renewing certs. Inside my network I have my PiHole configured to return the local IP for each service.

Nothing exposed to the internet at all. There is a record of my hostnames on Let's Encrypt but not concerned if someone will, say, deduce apollo-idrac is the iDRAC service for a Dell rackmount server called apollo and the other Greek/Roman gods are VMs on it. Seemed like a house of cards that would never work reliably, but three odd years later I only have issues if a DNS resolver insists on bypassing my PiHole. And that DNS resolver is SystemD-ResolveD which should crawl back into whatever hellhole it came out of.

You're supposed to upload the CSR, not the key.

But yeah, if they do all the generation themselves, they also have the private key and could easily break into anything the cert is used for.

Good point. Although they are also hosting my DNS, so they can take the site over anytime they want anyway?

Just setup cert-manager for a client at our work thats moving to a Kubernetes cluster. Setup the ACME issuer using DNS Cloudflare challenges, its awesome how simple it is to even get internal hostnames with certs.