HN Explorer

Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates (anchor.dev)

80 points by geemus ↗ HN
From the cryptic terminal commands to the innumerable ways to shoot yourself in the foot, I always struggled to use TLS certificates. I love how much easier (and cheaper) Let's Encrypt made it to get certificates, but there are still plenty of things to struggle with.

That's why we built Relay: a free, browser-based tool that streamlines the ACME workflow, especially for tricky setups like homelabs. Relay acts as a secure intermediary between your ACME client and public certificate authorities like Let's Encrypt.

Some ways Relay provides a better experience:

  - really fast, streamlined certificates in minutes, with any ACME client
  - one-time upfront DNS delegation without inbound traffic or DNS credentials sprinkled everywhere
  - clear insights into the whole ACME process and renewal reminders
Try Relay now: https://anchor.dev/relay

Or read our blog post: https://anchor.dev/blog/lets-get-your-homelab-https-certifie...

Please give it a try (it only takes a couple minutes) and let me know what you think.

12 comments

[ 7.2 ms ] story [ 35.6 ms ] thread
xmprt
I'm sure some people would find this useful but forgive me if I'm not ready to hand away my security to some unknown third party company. I don't know the first thing about CAs but Let's Encrypt really isn't that difficult to understand.
NoahZuniga
Your site doesn't work. The right arrow button is always disabled
aeaa3
Does this means that you have the ability to

a) impersonate the identities of your users and b) decrypt the SSL traffic of your users

?

traceroute66
Oh dear.

I'm sorry. But do you really need to re-invent the wheel yet again ?

Go to the Let's Encrypt website, there is a whole page of client implementations[1].

What makes yours better than, for example, `lego` or `caddy` or `step` ?

All of which are easy to use, come with sensible defaults and do not provide you with "innumerable ways to shoot yourself in the foot".

And for people who really can't use Let's Encrypt because "its difficult", there are still all the old-school, well-established, commercial CA's out there who will hold your hand in return for a few dollars.

[1] https://letsencrypt.org/docs/client-options/

nodesocket
I'm a bit confused the benefits? Caddy already makes Let's encrypt incredibly easy. I use the CloudFlare DNS provider, so don't even need to expose port 80 for http verification.
bananapub
for everyone willing to put a tiny amount of effort in, you can just:

1. Install acme-dns somewhere

2. Point part of your domain to that

3. Use lego or caddy or whatever to get certs using dns-01

No need to pay some dude who can then forge certs for your domain.

[deleted]
(comment deleted)
bobbob1921
I’ve never understood why there isn’t an easy way (ie that never expires) to use certificates or otherwise encrypt communications. I’m mainly referring to unique or internal use cases where the complications around certificates expiring has made it so that those communications end up unencrypted (SSL disabled). I guess what I’m saying is I’ve come across many cases where even bad encryption is better than plaintext, yet plaintext has to get used because of some element of certificates expiring needs renwal. Even bad or easy to crack encryption is better than plain text, yet I totally get why many scenarios end up using plain text (i’m talking in an internal or home lab type set up). I understand why public facing certificates need renewals
codegeek
Or just use caddy as a reverse proxy [0]. This 1 line will do it all for you:

    myawesomedomain.com {
         respond "You just loaded this on https"
    }
[0] https://caddyserver.com