TLS more.....

[fmohican]

It's possible to add support for more format like PKCS#7, DER, PKCS#12, and support for self-signed certificate (single cert. or CA)

Thanks!

[daniel-123]

While adding support for multiple certificate formats would be feasible, I don't really see a good enough justification for it:

• PEM we support is the same format you get certificates from Let's Encrypt which is by far the most easily available source of certificates signed by roots that are trusted by most software.
• Supporting one common format is basically the industry standard among web servers etc.
• You can easily convert between formats using external tools.

With regards to the second part about self-signed "single cert. or CA": it's not completely clear to me what you mean. I assume you mean two scenarios:

• A typical self-signed certificate
• Complete certificate chain, but signed with your own CA.

Second scenario of those two will already work. Only extra step is that clients also need to add your CA to their trusted CA bundle.

With regards to first scenario with self-signed cert I have similar opinion as with certificate formats - it is feasible, but I see little justification:

• You can easily get free domain validated certificates from Let's Encrypt.
• You can easily get free domain names from likes of duckdns.org.
• In terms of provided features self-signed certificate is very similar to situation with rolling your own CA, which is already possible to use.
• It would probably imply extra work with regards to the UI (I assume you don't want to just direct the user to manually add the cert to their trusted CA bundle).

[fmohican]

• Complete certificate chain, but signed with your own CA.

Second scenario of those two will already work. Only extra step is that clients also need to add your CA to their trusted CA bundle.

That will work in my case, but will be nice if we can just have TSL (or only TSL), without 'server validation', just to crypt packages, also i already have my own free domain (.ml/.ga/.tk), with Let's Encrypt. However Let's Encrypt issues format PEM format but with extension ".crt" & ".key" (in term of format ins't any difference), but syncplay work only with .pem extension.

Will be nice if server had a config file and a GUI, to set all thing, after just register as "services" (on windows).

Thanks for quick answer. That help me a lot, i was unsure about "own CA scenario". Thanks for make crystal clear.

[daniel-123]

However Let's Encrypt issues format PEM format but with extension ".crt" & ".key"

On two servers where I have it deployed Let's Encrypt client (certbot on Linux) creates following files: cert.pem chain.pem fullchain.pem privkey.pem. I always assumed this is the default and that's the reason why Syncplay specifically looks for those filenames. Are you using some other Let's Encrypt client?

While a GUI for server is probably not going to happen any time soon, a configuration file for server has been an idea that's floating around.

[fmohican]

I'm on windows atm, and certbot isn't work as excepted, so i use an website that generate cert for you https://www.sslforfree.com/ , i just add *.domain.tld and domain.tld, put text-records and done. The site generate via let's encrypt API, 3 filescertificate.crt, chain.crt and private.key

I didn't have time to setup an automation like certbot, or look over other clients like.... However that is my personal case. //edit: My case its "apart", my ISP assign Dynamic IP, so i need to use a tool like Dynu to update records every time, Dynu have an API, i need to setup more "complicated" thing to update cert with Let's Encrypt clients, so simple way its just to update it manual every 3m.

[daniel-123]

Dynamic IP

That's just a side note that gets slightly offtopic: IP address isn't anywhere in the cert. So if you have a dynamic IP, but on top of it a dynamic DNS service which updates the IP your domain name points at - the certificates will work exactly the same way as for static IPs.

[fmohican]

Yes i know that, but think like that nameserver are setted to dynamic ip server (dynu) witch have own API, to create valid cert, we need to add TXT record to dynu's server, so i need to make 3rd party app to get txt from certbot (or other clients of Let's Encrypt) and update record on Dynu server.