-
Notifications
You must be signed in to change notification settings - Fork 1.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Adds ACME - auto cert management #5178
Conversation
This commit fixes #5177 Initial implementation uses dir backend as a cache and is OK for small clusters, but will be a problem for many proxies. This implementation uses Go autocert that is quite limited compared to Caddy's certmagic or lego. Autocert has no OCSP stapling and no locking for cache for example. However, it is much simpler and has no dependencies. It will be easier to extend to use Teleport backend as a cert cache. ```yaml proxy_service: public_addr: ['example.com'] # ACME - automatic certificate management environment. # # It provisions certificates for domains and # valid subdomains in public_addr section. # # The sudomains are valid if there is a registered application. # For example, app.example.com will get a cert if app is a regsitered # application access app. The sudomain cookie.example.com is not. # # Teleport acme is using TLS-ALPN-01 challenge: # # https://letsencrypt.org/docs/challenge-types/#tls-alpn-01 # acme: # By default acme is disabled. enabled: true # Use a custom URI, for example staging is # # https://acme-staging-v02.api.letsencrypt.org/directory # # Default is letsencrypt.org production URL: # # https://acme-v02.api.letsencrypt.org/directory uri: '' # Set email to receive alerts and other correspondence # from your certificate authority. email: 'alice@example.com' ```
Hey folks, I've been improving our docs from the perspective of an inexperienced user who has no idea about Teleport. One of the obstacles for such user is the amount of work required to get a single node cluster that is secure. It requires quite a lot of work with certificates, DNS records and other plumbing just to get started. After I have added ACME support, Teleport became more fun for compared to the manual cert setup. |
GetAppServers(context.Context, string, ...services.MarshalOption) ([]services.Server, error) | ||
} | ||
|
||
// ResolveFQDN makes a best effort attempt to resolve FQDN to an application | ||
// running a root or leaf cluster. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
// running a root or leaf cluster. | |
// running in a root or leaf cluster. |
@russjones @fspmarshall can you guys take a look at it when you have a chance in case if you any concerns. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Code & UX looks good to me. I'm not familiar enough with ACME to comment beyond that.
This commit fixes #5177
Initial implementation uses dir backend as a cache and is OK
for small clusters, but will be a problem for many proxies.
This implementation uses Go autocert that is quite limited
compared to Caddy's certmagic or lego.
Autocert has no OCSP stapling and no locking for cache for example.
However, it is much simpler and has no dependencies.
It will be easier to extend to use Teleport backend as a cert cache.