ACME support

[vixns]

Automated letsencrypt certificates creation / renewal would be great.

[ldemailly]

it would be great to get envoy listed on https://certbot.eff.org/

[thekalinga]

I have created an issue as part of cert-manager.

Since cert-manager has integration for nginx & haproxy, anyone with back sufficient background (I dont have) should be able to add support for envoy aswell

cert-manager/cert-manager#238

[thekalinga]

As per the this comment by the author of cert-manager, acme integration with any ingress controller(incl envoy) should work out of the box.

Unfortunately, I currently don't have any external facing hosting I can point to test acme integration right now. Can anyone test this & confirm?

[ldemailly]

I'll give it a try

[ldemailly]

got it to work in a maybe not simple enough way (but it's a start)

istio/istio#2310 (comment)

even if this solves the kubernetes/istio case, it would be nice to have envoy out of the box on https://certbot.eff.org/

[kkimdev]

Traefik for example makes the acme integration very seamless. This is all user has to do:

https://docs.traefik.io/user-guide/docker-and-lets-encrypt/

[acme]
email = "your-email-here@my-awesome-app.org"
storage = "acme.json"
entryPoint = "https"
onHostRule = true
[acme.httpChallenge]
entryPoint = "http"

I think it greatly improves user experience, and it will be awesome to have a similar support in Istio.

[lizan]

Now we have secret discovery service ready, it should be straight forward to implement an envoy plugin in certbot.

[blaggacao]

Is there any hard design argument for NOT dis-intermediating cert-manager?

[bbigras]

Any progress on this?

[saksmt]

3 years, guys, seriously...

[cetanu]

If anyone can point me to an example where they've actually used certbot in conjunction with Envoy, I can probably try to write up a basic document explaining how this could be implemented... and then leave the cpp experts to do the impl.

Personally I'm interested in doing this on my control plane, and having it just hand the certs to envoy, but I just don't grok ACME+Envoy enough yet.
Presumably if DNS for a domain is already pointed at my proxies, then I can configure a listener on port 80 to send a direct response for the verification bit... that should yield a cert which I can then send through SDS or add to the transport socket of a HTTPS listener. That's the theory, right?

[mattklein123]

If anyone can point me to an example where they've actually used certbot in conjunction with Envoy, I can probably try to write up a basic document explaining how this could be implemented... and then leave the cpp experts to do the impl.

I think most (all?) Envoy ingress controllers implement this, so I would look at Amabassador/Contour/Gloo/etc.

That's the theory, right?

The TLS cert providers are actually pluggable at this point, so I think we can theoretically build an ACME cert provider and have it all be built-in. I would love to see this happen, but the reason it hasn't happened yet is that everyone just does it with a sidecar and it's not a burning need.

[micheas]

Ambassador relies on certmanager to deal with the certificate management and takes a reload cue from certmanager. Probably the path you want to take here. It insulates envoy from a potentially hostile input from the certificate renewal process.

…

On Sun, Oct 11, 2020, 10:14 AM Matt Klein ***@***.***> wrote: If anyone can point me to an example where they've actually used certbot in conjunction with Envoy, I can probably try to write up a basic document explaining how this could be implemented... and then leave the cpp experts to do the impl. I think most (all?) Envoy ingress controllers implement this, so I would look at Amabassador/Contour/Gloo/etc. That's the theory, right? The TLS cert providers are actually pluggable at this point, so I think we can theoretically build an ACME cert provider and have it all be built-in. I would love to see this happen, but the reason it hasn't happened yet is that everyone just does it with a sidecar and it's not a burning need. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#96 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABWEL7DMXRUYABG2UTZXZLSKHRVXANCNFSM4CQTEFAA> .

[phlax]

Probably the path you want to take here.

from my understanding cert-manager depends on kubernetes.

i think ideally we want something that can work outside of kubernetes

[karimhm]

+1

[sgohl]

if you really consider implementing acme support, please make it better than the weird design decision traefik did make, with this acme.json with all certs in a custom format within a single file. this is ridiculous
I even would appreciate it more, if it'd be talking deeply to certbot instead of reinventing the wheel

[huan]

I can't believe that envoy lack this support for the user, in 2021! (I'm new to envoy from this week)

[DeltaLaboratory]

No support has been added even after six years?

[cetanu]

I created a proof of concept that solves this problem without code changes to Envoy:

An ACME server receives domain names, creates a HTTP01 challenge, passes the challenge to an XDS control-plane.
The control-plane passes the routes to envoy over RDS. Envoy then serves the challenge on port 80.
The ACME server checks that the route has propagated, and then posts to lets-encrypt for validation.
Lets-encrypt hands back a cert to the ACME server, which is then passed to the XDS control plane, which passes the secret to envoy over SDS.

It took me a few days to set this up including time spent finding the right ACME library for the purpose and understanding the protocol to a meaningful extent.

If you can't wait years, then maybe spend a week or two doing this. You can use the go-control-plane to accomplish it. I personally have my own control-plane that I built from scratch.

Otherwise, working out how to contribute a PR for this might be an alternative.

[phlax]

Otherwise, working out how to contribute a PR for this might be an alternative.

amazing! thanks @cetanu

can i suggest a way we can publish this recipe...

lets add a sandbox that has all the parts required and uses the ACME test server (i think there is a container for it already)

i would be really happy to help with this if i can, or to implement the sandbox if im clear about what parts are needed

[phlax]

(for ref see https://github.com/envoyproxy/envoy/tree/main/examples for existing sandboxes)

[alantbarlow]

The lack of this feature is the exact reason I am considering using Caddy instead. They handle Automatic HTTPS Cert Generation by default without any configuration needed. I don't mind configuring the feature as long as it does everything automatically once enabled.

[arminabf]

still no implementation in sight?

[ldemailly]

As a reminder if you're on kubernetes, use https://cert-manager.io/ (I realize this doesn't help if you're not)

[arminabf]

As a reminder if you're on kubernetes, use https://cert-manager.io/ (I realize this doesn't help if you're not)

I think SDS is the way to go for us...