Hey everyone,
Just a quick question, let’s encrypt, what is it and how can I take advantage of its services?
For a bit of background I’m trying to setup KanIDM and the need for a ca certificate is needed, I was told to use let’s encrypt to create it.
Just looking for knowledge.
Thanks!
Use Caddy as a web server and forget about setting up certificates forever. This masterpiece will take care of it.
Kanidm wants to directly have access to the letsencrypt cert. It refuses to even serve over HTTP, or put any traffic over it since that could allow potentially bad configurations. It has a really stringent policy surrounding how opinionated it is about security.
Do they know about reverse proxies?
Yeah. There’s reasoning for why they do it on their docs, but the reasoning iirc is kanidm is a security critical resource, and it aims to not even allow any kind of insecure configuration. Even on the local network. All traffic to and from kanidm should be encrypted with TLS. I think they let you use self signed certs though?
I’m going to cast another vote for a reverse proxy, such as NginxProxyManager. It’s really easy to set everything up, and they’re usually very easy to run in Docker/Podman.
One thing to note: if you end up with a domain with mandatory HSTS, you’ll have to use DNS-based certificate generation rather than HTTP based, since unencrypted HTTP is blocked (chicken/egg problem to get HTTPS working). It’s not hard, but you have to be aware of that limitation.
As someone that used Nginx for close to decade, Caddy is about 10x simpler with the same features. It takes a bit to wrap your head around if you’re used to coming from an “old-school” webserver and proxy like Apache or Nginx though. One of the greatest things about Caddy is that it does SSL by default, so there’s no need to have stanzas in each section saying “listen on 80 and 443, but if you get a connection on 80 redirect it to 443” and another one saying “enable SSL for this (sub)domain”. Creating a reverse proxy in Caddy literally takes three lines and consists of FQDN { reverse_proxy internal-endpoint-name:portNumber }
I don’t know KanIDM specifically so take this with a grain of salt.
Let’s Encrypt only provides server certificates. The kind used to secure a connection (HTTPS, IMAPS, etc). KanIDM might require a Certificate Authority (CA) certificate to issue Client Certificates (used for authentication like MIME-S, WPA Enterprise, etc). Let’s Encrypt cannot be used for this purpose.
