Conversation

This Tweet was deleted by the Tweet author. Learn more
Nico Berlee
@NicoBerlee
Replying to
@DanielMicay
Actually you don't need wildcards, try_files and if not exist proxing the .wellknown requests across all your servers works very well.. (and deny already proxied requests in order to prevent loops) its straight forward nginx config, but i have samples if you like
2
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
and
@NicoBerlee
If the keys weren't the same across each server, we'd need to have separate SSHFP and TLSA records for each, which we don't want to end up doing. It's a lot simpler to have the same key across them and that seems to make sense. Also fewer certificates spamming CT logs.
1
Nico Berlee
@NicoBerlee
Replying to
@DanielMicay
I see you are actually doing DANE-EE and not DANE-TA which is common for LE. Strict pinning is nice but excludes autorotating your keys with certbot. SSH CA gives you more security and flexibility compared to pinning. I don't see how a few CT logs are a real problem
1
Daniel Micay
@DanielMicay
Replying to
@NicoBerlee
I don't want to simply trust LE since they simply verify domain control via unauthenticated HTTP connections. I don't really see the advantage of having separate keys across servers with the exact same purpose. Since they can be accessed via SSH, that workstation is trusted.
1
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
and
@NicoBerlee
I don't see an advantage to having separate TLS keys and certificates for each replica. The certificates would be entirely interchangeable. Each key would need to be pinned via TLSA and they'll be valid across the servers. I don't see any real downside to syncing that across.
1