This behavior is different than the last time I setup a reverse proxy like this. But that was also on CentOS 7 and not Fedora. So policy could be different.
@NashBrydges side question. If you setup the .well-known to work correctly, why do you then need the HA? because nginx will never be down except for the momentary reload after the certs are updated.
That certainly addresses the biggest concern about a long downtime during the renewall process for a high number of certs and probably addresses most concerns with this client. He's already running Veeam replication to a second box so his RTO and RPO are relatively short and within his business tolerance.
Having said that, it's a great learning opportunity for me to set this up in my lab, if for no other reason than to try it and see how it works.
Certainly no reason not to do it for a lab. and for a proxy with as much as it sounds like you have in production, it will still be a likely good solution.
One of the main reasons that normal certs cannot be bought with forever expiration is because then people would be less apt to update them as ciphers are broken.
Look at how many people still use(d) SSLv1 SHA1, etc., long after they were proven broken.
@scottalanmiller Just testing it out for now but so far so good. I had a client ask me for a good document management solution that wouldn't break the bank and could be hosted locally so I immediately thought of this. I've given him access to see if this could work and from the sounds of his feedback, he might want it setup.
Cool, would be good to see some threads on it. Been so long since I've used it.
I use the hosted one. They gave you 10GB for free. Idk if they still do that or not.
I didn't even know that they did hosted.
Ya the free one didn't seem advertised much. I'll have to see if I can find a sign up link again.
Yep, got all that done and it's working well. What I was referring to was redirecting traffic to HTTPS. Essentially this is the part of the file I was missing...
This way you can share the config(s) under conf.d between multiple machines using the same roles (or whatever Salt calls them) and have different main NGINX server settings.
Never had to do that. Seems like a script to pull it from time to time might be enough, though?
Set up a passwordless scp of the /etc/letsencrypt (or /etc/certbot?) folder from the proxy to the internal machine?
Any security risk to this? I don't know anything about it - I just see passwordless and have to ask.
It's industry standard public/private key encryption, so shouldn't be an issue.
You should go read up on SQRL. In my not so humble opinion, passwords have long outlived the point where they are a useful security mechanism.
I'm fully aware of SQRL - I asked Scott on Day one of ML if he would support it when it became available, sadly it's still not released to the wild 😞
