💾 Archived View for bbs.geminispace.org › s › Gemini › 4516 captured on 2024-08-18 at 22:08:53. Gemini links have been rewritten to link to archived content
⬅️ Previous capture (2024-07-09)
-=-=-=-=-=-=-
How many here use the same TLS certificate on their gemini server that they get for their web server? I found it not too hard to setup. I am surprised I don't see more gemini capsules doing the same.
2023-08-19 · 1 year ago
🧶 betabube · 2023-08-19 at 05:23:
I've used solderpunk's gemcert because as ow nof I'm on gemini only, no http so far.
☕️ Morgan · 2023-08-19 at 06:09:
I use letsencrypt for web, but I think the short expiry would be annoying for gemini; so I use self signed.
🤖 alexlehm · 2023-08-19 at 07:49:
I am using letsencrypt and reuse the private key each time to avoid getting a new cert hash when it is renews. that seems to work fine
☕️ Morgan · 2023-08-19 at 07:54:
@alexlehm Good to know that's an option, thanks! Is that the default or is some special setup needed?
🔭 Supernova [OP] · 2023-08-19 at 13:48:
Oh thank you @michaelnordmeyer and @Morgan for bringing up the point about getting notified when there is a new cert. I've tried to find posts about the differences between self-signed and CA certs and never came across that info. I suppose that doesn't effect any functionality, it's just a notification the user has to dismiss each time?
@alexlehm can you explain further or provide a link to more info on using the same key?
How about this for a thought? If I generate a long expiring cert from LetsEncrypt once just for the gemini server and save that seperately. Then let LetsEncrypt do it's normal thing (every 3 months) for the web server?
🤖 alexlehm · 2023-08-19 at 15:26:
@Morgan is set the parameter reuse_key = True in renewal.conf, that seems to keep the same cert data so that the hash does not change
🤖 alexlehm · 2023-08-19 at 15:27:
@Supernova I believe this only requires the parameter reuse_key = True in the config. It is not possible to create long expiring certs with Letsencrypt, the expire time is automatically 3 months, you cannot change that
🍀 gritty · 2023-08-19 at 17:08:
for those using LE, are you copying your keys to the user running your server? I ask because after using certbot, the directory holding the LE certs is not viewable by a regular user on my machine.
🤖 alexlehm · 2023-08-19 at 17:36:
I copy the files with sudo and access them with the user the server is running under
🔭 Supernova [OP] · 2023-08-19 at 23:09:
@alexlehm Oh there is a runtime option, and I use docker certbot so I think I can use it this way:
docker compose run --rm certbot renew --reuse-key
I will see what happens next month upon renewal 😁
🐉 gyaradong · 2023-08-20 at 04:34:
I see the purpose as different. The point of minting a key is to have a centralised chain of trust. I think the key life times are for the CA to validate or audit the keys. CRLs are not always effective, so everything must have a lifetime.
In Gemini, it's TOFU so the utility of a lifetime and of minting are both limited and across purposes.