Re: [Pound Mailing List] Pound + Letsencrypt for Play Framework & AWS CloudFront

Mike Slinn <[email protected]> Fri, 23 Feb 2018 10:30:08 -0800
Newsgroups	gmane.comp.web.pound.general
Message-ID	<[email protected]>
This is a multi-part message in MIME format.
--------------36704FEB05A1A4CEC8104044
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

Thomas,

Thanks for taking the time to respond. This might be best discussed on 
the serverfault page 
<https://serverfault.com/questions/897909/pound-letsencrypt-for-play-framework-aws-cloudfront>. 
To address your points:

 1. Most DNS requests on the internet are unsecured. Why would this
    issue be any different? Remember, the letsencrypt server connects to
    Pound to initiate a DNS or HTTP challenge, not the other way around.

 2. For an HTTP challenge, the letsencrypt server only utilizes ports 80
    or 443, and those are already in use by the running Pound instance,
    as you know. Pound does not support virtual directories, and the
    webapp does not support virtual directories either. The new service
    you propose is therefore unworkable in this scenario.

 3. I solved the letsencrypt challenge problem myself using a DNS
    challenge, and the complete solution to creating and deploying the
    resulting SSL certificate is shown on the serverfault page. A few
    questions have yet to be resolved, and I welcome a discussion on
    those remaining points. There is no need to discuss the pros and
    cons of the relative value of a DNS challenge vs a webapp challenge,
    because that part was done, tested and deployed.

Thanks,

Mike


--------------36704FEB05A1A4CEC8104044
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    Thomas,<br>
    <br>
    Thanks for taking the time to respond. This might be best discussed
    on the <a moz-do-not-send="true"
href="https://serverfault.com/questions/897909/pound-letsencrypt-for-play-framework-aws-cloudfront">serverfault
      page</a>. To address your points:<br>
    <ol>
      <li>Most DNS requests on the internet are unsecured. Why would
        this issue be any different? Remember, the letsencrypt server
        connects to Pound to initiate a DNS or HTTP challenge, not the
        other way around.<br>
        <br>
      </li>
      <li>For an HTTP challenge, the letsencrypt server only utilizes
        ports 80 or 443, and those are already in use by the running
        Pound instance, as you know. Pound does not support virtual
        directories, and the webapp does not support virtual directories
        either. The new service you propose is therefore unworkable in
        this scenario.<br>
        <br>
      </li>
      <li>I solved the letsencrypt challenge problem myself using a DNS
        challenge, and the complete solution to creating and deploying
        the resulting SSL certificate is shown on the serverfault page.
        A few questions have yet to be resolved, and I welcome a
        discussion on those remaining points. There is no need to
        discuss the pros and cons of the relative value of a DNS
        challenge vs a webapp challenge, because that part was done,
        tested and deployed.</li>
    </ol>
    <p>Thanks,</p>
    <p>Mike<br>
    </p>
  </body>
</html>

--------------36704FEB05A1A4CEC8104044--

--
To unsubscribe send an email with subject unsubscribe to [email protected]
Please contact [email protected] for questions.