ThatGuyJack/nginx-proxy-manager
1
0
Fork 0
mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2025-10-31 07:43:33 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Updated deps, go.19 migration, nginx template work

Browse Source
This commit is contained in:
Jamie Curnow
2022-11-08 10:03:45 +10:00
parent 8d37f5df8d
commit c00b690ed3
23 changed files with 375 additions and 376 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
docs/dev-notes/README.md Normal file
View File

@@ -0,0 +1,48 @@
# Development Notes
Requesting a SSL Certificate is a complicated process to understand.
This is an explanation of how the ACME standard of certificates works.
## Certificate Request via HTTP validation
1. You define `website.example.com` DNS record to point to `123.45.67.89`
2. You ask a Certificate Authority to give you a Certificate and initiate validation from their side
3. The CA gives you a token, and you should be running a http-only webserver on `123.45.67.89` that returns this token
4. The CA makes a request to your domain `http://website.example.com/.well-known/acme-challenge/` and gets the token
5. If the CA thinks the token matches, they issue you the certificates.
## Certificate Request via DNS validation
1. You ask a Certificate Authority to give you a Certificate and initiate validation from their side
2. The CA gives you a token, and you update the DNS records on your domain with this token
3. The CA checks the DNS record, with a timeout waiting for propagation
4. If the CA thinks the token matches, they issue you the certificates.
## ACME DNS in an isolated test environment
### Local CA
In order to have a local ACME compatible CA that you can control, you have 2 options:
- pebble by Letsencrypt
- stepca by Step
stepca is better as it has better DNS Acme validation support.
### Local DNS Provider
PowerDNS is a really good, free DNS server and acme.sh has support for it.
### Getting things to work together
Since your don't really own `website.example.com` and if you hit it with your system DNS
it will fail, you'll need to use a custom DNS responder to return an A record for this
that points to your running NPM gateway. My [dnsrouter](https://github.com/jc21/dnsrouter)
project accomplishes this nicely. After this is setup, as long as the resolv.conf points
to this dns responder, the resolution should work locally.
1. You ask the stepca CA to give you a Certificate and initiate validation
2. The CA returns a token, and you update the PDNS records on your domain with this token
3. The CA checks the DNS record, with a timeout waiting for propagation
4. If the CA thinks the token matches, they issue you the certificates.