I’m not even sure this title makes sense. I’m looking to handle LE certificates in cloudflare automatically. Specifically multi level subdomains.

You can hand off subdomain certs to them for single level, but the moment you want multi level you need to manage the certs yourself.

What I’m hoping for is an open source/self hosted tool that is meant to handle certificate requests and distribution. I just don’t know if such a tool even exists, and searching around hasn’t yielded results.

Does anyone have any thoughts?

  • KairuByte@lemmy.dbzer0.comOPEnglish
    1·
    10 days ago

    I’m looking for a way to both get a sub wildcard (I don’t know the exact wording but *.sub.domain.com would be an example) and push it into cloudflare. So a direct certbot install with manual distribution, while technically possible, sounds absolutely abysmal. I’d rather forget the entire idea than deal with that.

    • nitrolife@hikki.teamEnglish
      2·
      10 days ago

      In any program, you still have to execute a challenge somewhere. No program will issue certificates without that. In the case of certbot, you can simply write a small post hook that will transfer the certificates to cloudflare.

    • moodoovoodoo@lemmy.worldEnglish
      1·
      10 days ago

      Why not handle certs on your end and just use CF for proxy? I use NPM for cert automation with CF proxying. It’s honestly ridiculous easy and I’ve had no issues.

        • moodoovoodoo@lemmy.worldEnglish
          1·
          8 days ago

          Depends on your config, I’m just doing DNS (proxied). So you hit my nginx and that’s where the cert is provided.

          • KairuByte@lemmy.dbzer0.comOPEnglish
            1·
            8 days ago

            Have you actually confirmed that is the case? My understanding is that cloudflare pretty much always re-signs with their own SSL cert. and I’m fairly certain that would be absolutely required when using their DNS proxies.

              • KairuByte@lemmy.dbzer0.comOPEnglish
                1·
                1 day ago

                Yes, it’s also how I run all my services. I checked just this moment, and locally my certs verified by field is Let’s Encrypt, while remotely that field is Google Trust Services

                I have never personally provisioned a cert from Google. I have only ever utilized Let’s Encrypt. That leaves just one involved party that could have requested, received and presented this cert: Cloudflare.

      • KairuByte@lemmy.dbzer0.comOPEnglish
        1·
        9 days ago

        Cloudflare will only handle certs to the first subdomain, after that you either have to provide them. Or they may charge for it, I’m not sure anymore, but I’m going full free tier so I still need to provide them.