search

caddyserver / certmagic

Automatic HTTPS for any Go program: fully-managed TLS certificate issuance and renewal
https://pkg.go.dev/github.com/caddyserver/certmagic?tab=doc
Apache License 2.0
4.89k stars 278 forks source link

Implement ARI #284

Closed mholt closed 2 months ago

mholt commented 2 months ago

The ACME Renewal Information (ARI) spec might be starting to stabilize, and Let's Encrypt just announced that renewals complying with ARI will not be rate limited. That was my primary concern, was intentionally refusing service to clients especially during times of infrastructure strain when reliability is already questionable and the renewal window is narrowing.

This sets a good precedent going forward and hopefully other CAs who implement ARI will follow their example.

I still have multiple reservations regarding the philosophy behind ARI, but I think it's probably worth implementing, at least with some configuration, since the policies behind ARI can still vary between CAs. For example, a CA might offer ARI, but in a way that does not actually help you ensure reliability when you comply with it. CertMagic's implementation will balance site uptime with optional protocols.

Let's Encrypt has an article to guide the implementation of ARI. ACMEz, CertMagic's underlying ACME library, already supports the latest ARI draft, but CertMagic will need to keep track of state and do some polling and scheduling to make ARI happen for the user.

oliverpool commented 2 months ago

Tailscale Takeaways could be interesting to look at (BSD-3 license).

mholt commented 2 months ago

This is being staged at https://github.com/caddyserver/certmagic/pull/286