I’m not even sure this title makes sense. I’m looking to handle LE certificates in cloudflare automatically. Specifically multi level subdomains.

You can hand off subdomain certs to them for single level, but the moment you want multi level you need to manage the certs yourself.

What I’m hoping for is an open source/self hosted tool that is meant to handle certificate requests and distribution. I just don’t know if such a tool even exists, and searching around hasn’t yielded results.

Does anyone have any thoughts?

  • moonpiedumplings@programming.devEnglish
    5·
    16 hours ago

    Certbot?

    It can automate provisioning of certificates using DNS-01 challenges, which have wildcard certificates.

    https://eff-certbot.readthedocs.io/en/stable/using.html#dns-plugins

    Example tutorial: https://www.digitalocean.com/community/tutorials/how-to-create-let-s-encrypt-wildcard-certificates-with-certbot

    Once you do that it puts the cert in /etc/letsencrypt/live/ so you can then do whatever you want with it. You would have to handle distribution manually.

    If you want to automate stuff across of a bunch of machines at once, I recommend Ansible: https://docs.ansible.com/projects/ansible/latest/index.html

    • KairuByte@lemmy.dbzer0.comOPEnglish
      1·
      13 hours ago

      I’m looking for a way to both get a sub wildcard (I don’t know the exact wording but *.sub.domain.com would be an example) and push it into cloudflare. So a direct certbot install with manual distribution, while technically possible, sounds absolutely abysmal. I’d rather forget the entire idea than deal with that.

      • lemmyvore@feddit.nlEnglish
        1·
        10 hours ago

        I would recommend reconsidering how you obtain LE certs. I ended up on Certbot too because it lets you own what is a critical part of your selfhosted identity. Plus Certbot works well and it’s maintained by the EFF who also see it as a critical project. As a local script (basically) sky’s the limit regarding automation.

        This is personal preference but I strongly prefer to locally control critical automations about my setup (certs, DDNS etc.)

        The certs produced by Certbot are portable and you can use them with CF, local reverse proxies, or whatever other infrastructure you may need. Just need to get a copy to the proper place (securely).

        I guess in the bigger scheme of things the question is whether you’re ok being tied to a particular service (like CF). I don’t, and I also don’t want to depend on the LE implementation of any particular reverse proxy (or their plugins).

        PS: Oh and another tip: if you do end up using a CLI tool for certs, stick to Certbot. I’ve tried pretty much everything else and they all suck. It’s actually unbelievable how much they suck. Arcane and opaque, the lot of them, which is not something you want from a critical tool.

      • moodoovoodoo@lemmy.worldEnglish
        1·
        11 hours ago

        Why not handle certs on your end and just use CF for proxy? I use NPM for cert automation with CF proxying. It’s honestly ridiculous easy and I’ve had no issues.

      • nitrolife@hikki.teamEnglish
        1·
        12 hours ago

        In any program, you still have to execute a challenge somewhere. No program will issue certificates without that. In the case of certbot, you can simply write a small post hook that will transfer the certificates to cloudflare.