this post was submitted on 28 Jul 2026
27 points (96.6% liked)

Selfhosted

61070 readers
1076 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
27
Centralized SSL certificate management? (lemmy.dbzer0.com)
submitted 3 days ago by KairuByte@lemmy.dbzer0.com to c/selfhosted@lemmy.world
17 comments fedilink hide all child comments
 

I’m not even sure this title makes sense. I’m looking to handle LE certificates in cloudflare automatically. Specifically multi level subdomains.

You can hand off subdomain certs to them for single level, but the moment you want multi level you need to manage the certs yourself.

What I’m hoping for is an open source/self hosted tool that is meant to handle certificate requests and distribution. I just don’t know if such a tool even exists, and searching around hasn’t yielded results.

Does anyone have any thoughts?

top 17 comments
sorted by: hot top controversial new old
[–] moonpiedumplings@programming.dev 6 points 3 days ago (1 children)

Certbot?

It can automate provisioning of certificates using DNS-01 challenges, which have wildcard certificates.

https://eff-certbot.readthedocs.io/en/stable/using.html#dns-plugins

Example tutorial: https://www.digitalocean.com/community/tutorials/how-to-create-let-s-encrypt-wildcard-certificates-with-certbot

Once you do that it puts the cert in /etc/letsencrypt/live/ so you can then do whatever you want with it. You would have to handle distribution manually.

If you want to automate stuff across of a bunch of machines at once, I recommend Ansible: https://docs.ansible.com/projects/ansible/latest/index.html

[–] KairuByte@lemmy.dbzer0.com 1 points 3 days ago (4 children)

I’m looking for a way to both get a sub wildcard (I don’t know the exact wording but *.sub.domain.com would be an example) and push it into cloudflare. So a direct certbot install with manual distribution, while technically possible, sounds absolutely abysmal. I’d rather forget the entire idea than deal with that.

[–] nitrolife@hikki.team 2 points 3 days ago* (last edited 3 days ago)

In any program, you still have to execute a challenge somewhere. No program will issue certificates without that. In the case of certbot, you can simply write a small post hook that will transfer the certificates to cloudflare.

[–] lemmyvore@feddit.nl 1 points 3 days ago

I would recommend reconsidering how you obtain LE certs. I ended up on Certbot too because it lets you own what is a critical part of your selfhosted identity. Plus Certbot works well and it's maintained by the EFF who also see it as a critical project. As a local script (basically) sky's the limit regarding automation.

This is personal preference but I strongly prefer to locally control critical automations about my setup (certs, DDNS etc.)

The certs produced by Certbot are portable and you can use them with CF, local reverse proxies, or whatever other infrastructure you may need. Just need to get a copy to the proper place (securely).

I guess in the bigger scheme of things the question is whether you're ok being tied to a particular service (like CF). I don't, and I also don't want to depend on the LE implementation of any particular reverse proxy (or their plugins).

PS: Oh and another tip: if you do end up using a CLI tool for certs, stick to Certbot. I've tried pretty much everything else and they all suck. It's actually unbelievable how much they suck. Arcane and opaque, the lot of them, which is not something you want from a critical tool.

[–] mhzawadi@lemmy.horwood.cloud 1 points 3 days ago (1 children)

Does cloud flare not do that?

They get certs so must have a way to get any kind of cert

[–] KairuByte@lemmy.dbzer0.com 1 points 3 days ago

Cloudflare will only handle certs to the first subdomain, after that you either have to provide them. Or they may charge for it, I’m not sure anymore, but I’m going full free tier so I still need to provide them.

[–] moodoovoodoo@lemmy.world 1 points 3 days ago (1 children)

Why not handle certs on your end and just use CF for proxy? I use NPM for cert automation with CF proxying. It's honestly ridiculous easy and I've had no issues.

[–] KairuByte@lemmy.dbzer0.com 1 points 3 days ago (1 children)

Cloudflare doesn’t pass the cert you have through, it generates its own cert (or uses one you provide).

[–] moodoovoodoo@lemmy.world 1 points 2 days ago (1 children)

Depends on your config, I'm just doing DNS (proxied). So you hit my nginx and that's where the cert is provided.

[–] KairuByte@lemmy.dbzer0.com 1 points 2 days ago

Have you actually confirmed that is the case? My understanding is that cloudflare pretty much always re-signs with their own SSL cert. and I'm fairly certain that would be absolutely required when using their DNS proxies.

[–] litchralee@sh.itjust.works 6 points 3 days ago* (last edited 3 days ago) (1 children)

Would cert-manager for Kubernetes be approximately what you're looking for? In that particular case, it's a service that runs in a K8s cluster, that can auto-request CSRs and send them to Lets Encrypt using one of the challenge types. It takes care of managing the returned certificates, such as renewing them before expiration and registering the private keys within the K8s key store.

I presume that you're not already using K8s, so maybe that project will help you find the keywords to describe the sort of certificate manager that you want.

[–] KairuByte@lemmy.dbzer0.com 1 points 3 days ago

I’m not currently using kubernetes but its something I’ve thought of looking into before. I’ll definitely give that a look for better terminology though!

[–] fireshell@kbin.earth 2 points 3 days ago (1 children)

Certimate It is a free and open source self-hosting tool designed to automate the complete management cycle of SSL certificates, including issuance, deployment, renewal and monitoring, using a visual interface.

[–] KairuByte@lemmy.dbzer0.com 1 points 3 days ago

Oh this looks very promising, thank you!!

[–] bigredgiraffe@lemmy.world 1 points 3 days ago (1 children)

Tools mentioned here are good suggestions but the problem you are going to run into is that CloudFlare doesn’t support second or higher level dns zones (so a record of a.b.c.com should be in a zone of b.c.com and CF only allows c.com) on most account tiers and LE/certbot is expecting a zone to create the validation record using its plugin.

[–] KairuByte@lemmy.dbzer0.com 1 points 3 days ago (1 children)

Oh… boy, that’s an angle I hadn’t considered.

Doesnt any dns challenge currently just look at domain.com to see if it can create the lower cert?

[–] bigredgiraffe@lemmy.world 1 points 1 day ago

Some of the acme clients do, I don’t think certbot does though. I remember using acme.sh or something and I think it calls it a delegation domain if I remember correctly!