I’m not even sure this title makes sense. I’m looking to handle LE certificates in cloudflare automatically. Specifically multi level subdomains.
You can hand off subdomain certs to them for single level, but the moment you want multi level you need to manage the certs yourself.
What I’m hoping for is an open source/self hosted tool that is meant to handle certificate requests and distribution. I just don’t know if such a tool even exists, and searching around hasn’t yielded results.
Does anyone have any thoughts?
You must log in or # to comment.
Certimate It is a free and open source self-hosting tool designed to automate the complete management cycle of SSL certificates, including issuance, deployment, renewal and monitoring, using a visual interface.
Certbot?
It can automate provisioning of certificates using DNS-01 challenges, which have wildcard certificates.
https://eff-certbot.readthedocs.io/en/stable/using.html#dns-plugins
Example tutorial: https://www.digitalocean.com/community/tutorials/how-to-create-let-s-encrypt-wildcard-certificates-with-certbot
Once you do that it puts the cert in
/etc/letsencrypt/live/so you can then do whatever you want with it. You would have to handle distribution manually.If you want to automate stuff across of a bunch of machines at once, I recommend Ansible: https://docs.ansible.com/projects/ansible/latest/index.html
I’m looking for a way to both get a sub wildcard (I don’t know the exact wording but *.sub.domain.com would be an example) and push it into cloudflare. So a direct certbot install with manual distribution, while technically possible, sounds absolutely abysmal. I’d rather forget the entire idea than deal with that.
Why not handle certs on your end and just use CF for proxy? I use NPM for cert automation with CF proxying. It’s honestly ridiculous easy and I’ve had no issues.
Cloudflare doesn’t pass the cert you have through, it generates its own cert (or uses one you provide).
Depends on your config, I’m just doing DNS (proxied). So you hit my nginx and that’s where the cert is provided.
Have you actually confirmed that is the case? My understanding is that cloudflare pretty much always re-signs with their own SSL cert. and I’m fairly certain that would be absolutely required when using their DNS proxies.
I have confirmed it - it’s how I run all my services
Tools mentioned here are good suggestions but the problem you are going to run into is that CloudFlare doesn’t support second or higher level dns zones (so a record of a.b.c.com should be in a zone of b.c.com and CF only allows c.com) on most account tiers and LE/certbot is expecting a zone to create the validation record using its plugin.
Oh… boy, that’s an angle I hadn’t considered.
Doesnt any dns challenge currently just look at domain.com to see if it can create the lower cert?
Some of the acme clients do, I don’t think certbot does though. I remember using acme.sh or something and I think it calls it a delegation domain if I remember correctly!
