Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: warn about endpoints no longer working, since tls-sni-01 is disabled #134

Merged
merged 1 commit into from
Jan 31, 2018
Merged

docs: warn about endpoints no longer working, since tls-sni-01 is disabled #134

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions docs/using.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,12 @@ directly with a database and pass an instance of this to the server endpoint.
Server endpoint string
----------------------

Note: as of 09-Jan-2018, the Let's Encrypt server has indefinitely
`disabled`_ the ``tls-sni-01`` validation method needed by these endpoints
(for new sites), due to a security problem. A future ``txacme`` release might
reimplement these with a different validation method: see `Issue 129`_ for
details.

The simplest way to use txacme is the stream server endpoint string. Two endpoint
parsers are provided, under the ``le:`` (Let's Encrypt) and ``lets:`` (Let's
Encrypt Test in Staging) prefixes. The endpoint takes as parameters a directory
Expand All @@ -42,6 +48,8 @@ store certificates in the ``/srv/www/certs`` directory:
the production environment is highly recommended.

.. _stringent limits: https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769
.. _disabled: https://community.letsencrypt.org/t/important-what-you-need-to-know-about-tls-sni-validation-issues/50811
.. _Issue 129: https://github.com/twisted/txacme/issues/129

The ACME client key will be stored in ``client.key`` in the certificate
directory, if this file does not exist a new key will automatically be
Expand Down