From 7d3f3071561b29d1abbbe7c287fd1906542d6c86 Mon Sep 17 00:00:00 2001 From: Mechiel Lukkien Date: Thu, 3 Oct 2024 21:16:19 +0200 Subject: [PATCH] acme port config option, explain why using a https reverse proxy will not work for acme tls-alpn-01 verification related to #218 by mgkirs --- config/config.go | 2 +- config/doc.go | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/config/config.go b/config/config.go index 70eadde431..86acb2b318 100644 --- a/config/config.go +++ b/config/config.go @@ -123,7 +123,7 @@ type ACME struct { DirectoryURL string `sconf-doc:"For letsencrypt, use https://acme-v02.api.letsencrypt.org/directory."` RenewBefore time.Duration `sconf:"optional" sconf-doc:"How long before expiration to renew the certificate. Default is 30 days."` ContactEmail string `sconf-doc:"Email address to register at ACME provider. The provider can email you when certificates are about to expire. If you configure an address for which email is delivered by this server, keep in mind that TLS misconfigurations could result in such notification emails not arriving."` - Port int `sconf:"optional" sconf-doc:"TLS port for ACME validation, 443 by default. You should only override this if you cannot listen on port 443 directly. ACME will make requests to port 443, so you'll have to add an external mechanism to get the connection here, e.g. by configuring port forwarding."` + Port int `sconf:"optional" sconf-doc:"TLS port for ACME validation, 443 by default. You should only override this if you cannot listen on port 443 directly. ACME will make requests to port 443, so you'll have to add an external mechanism to get the tls connection here, e.g. by configuring firewall-level port forwarding. Validation over the https port uses tls-alpn-01 with application-layer protocol negotiation, which essentially means the original tls connection must make it here unmodified, an https reverse proxy will not work."` IssuerDomainName string `sconf:"optional" sconf-doc:"If set, used for suggested CAA DNS records, for restricting TLS certificate issuance to a Certificate Authority. If empty and DirectyURL is for Let's Encrypt, this value is set automatically to letsencrypt.org."` ExternalAccountBinding *ExternalAccountBinding `sconf:"optional" sconf-doc:"ACME providers can require that a request for a new ACME account reference an existing non-ACME account known to the provider. External account binding references that account by a key id, and authorizes new ACME account requests by signing it with a key known both by the ACME client and ACME provider."` // ../rfc/8555:2111 diff --git a/config/doc.go b/config/doc.go index ca7cbb2409..a2e25711ac 100644 --- a/config/doc.go +++ b/config/doc.go @@ -113,8 +113,11 @@ See https://pkg.go.dev/github.com/mjl-/sconf for details. # TLS port for ACME validation, 443 by default. You should only override this if # you cannot listen on port 443 directly. ACME will make requests to port 443, so - # you'll have to add an external mechanism to get the connection here, e.g. by - # configuring port forwarding. (optional) + # you'll have to add an external mechanism to get the tls connection here, e.g. by + # configuring firewall-level port forwarding. Validation over the https port uses + # tls-alpn-01 with application-layer protocol negotiation, which essentially means + # the original tls connection must make it here unmodified, an https reverse proxy + # will not work. (optional) Port: 0 # If set, used for suggested CAA DNS records, for restricting TLS certificate