Unable to sattisfy challenge using DNS

[dogmatic69]

Per title and related to my ticket on local certs (#81), if it was possible to use DNS challenge instead of the HTTP challenge I could at least make local only certs that don't need an endpoint serving data.

The only requirement for a certificate as I understand it is to prove ownership of the domain. http is only one of many possible ways.

Making this line configurable should solve this problem. https://github.com/jc21/nginx-proxy-manager/blob/a72811ee256796ae72fc36441858d70ab9633300/src/backend/internal/certificate.js#L722

[jc21]

1 - This project doesn't handle dns letsencrypt options because it inhibits the user experience. This is an entry level project, for people who don't want to know more than they have to about the internet. Whil there might be a workflow to accomplish this for configured hosts, at this time I'm not planning to work on it.

2 - Even with a dns challenge for letsencrypt, if you're wanting a cert for foo.home you need to own that domain and have public dns configured. From what you've been saying in #81, you don't "own" foo.home domain.

[dogmatic69]

I realise that is the case which is why I’ve since purchased a domain.

According to your first point I should now purchase and maintain an endpoint that will respond to the challenges because setting up a single dns entry “inhibits user experience”?

It seems to me that changing http in the code I’ve linked to http,dns Is all that is required. Probably even better would be dns,http so that it does not timeout waiting for a http request. Hardly requires working on as it’s already supported by the certbot.

[jc21]

The goal of this project is to allow people who expose their home-hosted services to the internet simply and securely. You want to use this to host your private services but still want free SSL. I guess you don't trust your private network traffic.

You are welcome to make the change if you so feel. When you create a PR then CI will even create a docker image based on it for testing.

[dogmatic69]

I also want to expose my home hosted service to the internet, but will be doing so behind a VPN.

I trust private traffic to some extent, but am tired of having to accept SSL errors for the various apps I use so putting them behind a valid certificate will remove that pain.

I'll see if I have some time tonight to test out the change.

[dogmatic69]

I've tried to run this new image but its completely different to what I was running. In docker hub it says to run the following which is what I have.

    --name=nginx-proxy-manager \
    -p 8181:8181 \
    -p 8080:8080 \
    -p 4443:4443 \
    -v /docker/appdata/nginx-proxy-manager:/config:rw \
    jlesage/nginx-proxy-manager

Now it seems mysql is ripped out and all the files have moved around as docker-compose says

      - ./data:/data
      - ./data/letsencrypt:/etc/letsencrypt
      - .:/app
      - ./rootfs/etc/nginx:/etc/nginx```

[jc21]

Nowhere in this github repo or on my Dockerhub page does it mention to use the jlesage/nginx-proxy-manager docker image. That's someone else using my project with their own docker builds and the PR test docker images are not built with that.

[dogmatic69]

Explains some things, I'll spin up a new docker env to test it.

[jc21]

See #85 and #120