Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
It shouldn't be because you're not actually the owner of the IP address. If any user could get a cert, they could impersonate any other.
No, encryption only protects the confidentiality of data. You need message authentication codes or authenticated encryption to make sure the message hasn't been ~~transported~~ tampered with. Especially stream ciphers like ChaCha (but also AES in counter mode) are susceptible to malleability attacks, which are super simple yet very dangerous.
Edit: this post is a bit pedantic because any scheme that is relevant for LE certificates covers authenticity protection. But it's not the encryption part of those schemes that is responsible.
They're 'shortlived' 7 day certs, verified using a HTTP challenge. It doesn't matter who owns the IP, it's just a matter of who holds the IP.
Right, and for the challenge, you need to have access to a privileged port (which usually implies ownership), which you won't get assigned.
Ah right, completely forgot about that (80 for HTTP-01, 443 for TLS-ALPN-01). Is a bummer unfortunately