Which client support tls-alpn challenge?

saccleo · October 26, 2018, 9:03am

i want to use the client in asuswrt merlin, just because port 80 has been blocked by ISP.

i can use acme.sh, but it seemed that this client doesn’t support tls-alpn.
any suggestions?

thanks a lot for help!

tdelmas · October 26, 2018, 9:38am

Related: So how are we bringing TLS-ALPN to the masses?

TLS-SNI it’s not likely to be something that individual users will be using, at least not for a while.

These seem to support TLS-ALPN-01 (updated 2020-03-13):

ACME4J: tls-alpn-01 Challenge - acme4j
ansible: acme_certificate – Create SSL/TLS certificates with the ACME protocol — Ansible Documentation
Lego: GitHub - go-acme/lego: Let's Encrypt/ACME client and library written in Go
Golang/x/acme: acme package - golang.org/x/crypto/acme - Go Packages
dehydrated https://github.com/lukas2511/dehydrated/blob/master/docs/tls-alpn.md
Net::ACME2 Net::ACME2 - Client logic for the ACME (Let's Encrypt) protocol - metacpan.org
Acme.sh GitHub - acmesh-official/acme.sh: A pure Unix shell script implementing ACME client protocol (Acme.sh supports tls-alpn mode and buypass.com CA now)
Apache mod_md (support was added in the v1.99.0 release: Release mod_md v1.99.0 · icing/mod_md · GitHub)
Lets-proxy2 GitHub - rekby/lets-proxy2: Reverse proxy with automatically obtains TLS certificates from Let's Encrypt
win-acme https://www.win-acme.com
lua-resty-acme GitHub - fffonion/lua-resty-acme: Automatic Let's Encrypt certificate serving and Lua implementation of ACMEv2 procotol
uacme GitHub - ndilieto/uacme: ACMEv2 client written in plain C with minimal dependencies

Web servers compatible with TLS-ALPN-01:

Apache2 (EXPERIMENTAL with mod_md)
nginx (with dehydrated): https://github.com/lukas2511/dehydrated/blob/master/docs/tls-alpn.md#example-nginx-config
Lightttpd 1.4.53 (with dehydrated): HowToSimpleSSL - Lighttpd - lighty labs

saccleo · October 26, 2018, 10:45am

i see, thanks a lot.
then can i renew a certification by some client through port 443?

tdelmas · October 26, 2018, 11:02am

(2018-11-19: moved client list to first post)

Another solution would be a DNS challenge

cpu · October 26, 2018, 1:12pm

Two other ACME clients I know have TLS-ALPN-01 support:

Lego: GitHub - go-acme/lego: Let's Encrypt/ACME client and library written in Go
Golang/x/acme: acme package - golang.org/x/crypto/acme - Go Packages

saccleo · October 26, 2018, 2:42pm

Thanks for replies, I’ll try them.

tob · October 26, 2018, 3:08pm

github.com

lukas2511/dehydrated/blob/master/docs/tls-alpn.md

# TLS-ALPN-01

With `tls-alpn-01`-type verification Let's Encrypt (or the ACME-protocol in general) is checking if you are in control of a domain by accessing
your webserver using a custom ALPN and expecting a specially crafted TLS certificate containing a verification token.
It will do that for any (sub-)domain you want to sign a certificate for.

Dehydrated generates the required verification certificates, but the delivery is out of its scope.

### Example nginx config

On an nginx tcp load-balancer you can use the `ssl_preread` module to map a different port for acme-tls
requests than for e.g. HTTP/2 or HTTP/1.1 requests.

Your config should look something like this:

```nginx
stream {
  server {
    map $ssl_preread_alpn_protocols $tls_port {
      ~\bacme-tls/1\b 10443;

This file has been truncated. show original

FGasper · November 19, 2018, 7:02pm

Net::ACME2 supports it as well.

saccleo · November 26, 2018, 2:18am

i use lego to get right certifications

tdelmas · January 6, 2019, 1:56pm

(I reopened the subject so answers can be posted to ask to update the list)

cpu · January 18, 2019, 6:56pm

@tdelmas Apache mod_md has added experimental support for TLS-ALPN-01 in the v1.99.0 release: https://github.com/icing/mod_md/releases/tag/v1.99.0

_az · January 18, 2019, 8:41pm

you need a patched mod_ssl

Hope to see this upstreamed! Very exciting, we might be able to get back to ease-of-use of the TLS-SNI days.

gstrauss · January 27, 2019, 9:57am

lighttpd 1.4.53 supports TLS-ALPN-01 without the need to shut down the web server to handle TLS-ALPN-01 verification challenges. (lighttpd still needs to be restarted to begin using updated certificates)

https://redmine.lighttpd.net/projects/lighttpd/wiki/HowToSimpleSSL

rg305 · January 28, 2019, 1:33am

This post should be rewritten to emphasize that dehydrated supports TLS-ALPN-01 for cert renewals - so that it won’t be misinterpreted to read (as written):
“lighttpd 1.4.53 supports TLS-ALPN-01 …”

tdelmas · January 28, 2019, 12:38pm

dehydrated already have it's own line:

I wanted to emphasis that you can use TLS-ALPN-01 with lighttpd (as you can with apache2). But I'll try reorganize it.

rg305 · January 28, 2019, 8:54pm

I meant the post just above mine:

ndilieto · March 2, 2020, 7:02am

Just to add that ualpn should make TLS-ALPN-01 work with any webserver, without downtime.

ndilieto · March 13, 2020, 4:52pm

This is no longer experimental; the branch is now merged to master. Note that the proxying tls-alpn-01 responder is a standalone program and does not necessarily require uacme; it shouldn't be difficult to integrate other ACME clients with it.

Edit: forgot to mention a short tutorial on how to get tls-alpn-01 working

Topic		Replies	Views
So how are we bringing TLS-ALPN to the masses? Client dev	16	13923	June 20, 2018
Tls-alpn-01 support in certbot Client dev	3	8043	January 30, 2019
TLS-ALPN-01 support Site Feedback	1	1615	August 14, 2021
How to renew for Dynamic DNS host with no port 80? Issuance Tech	7	2821	January 7, 2019
Tls-alpn-01 with acme4j -> unauthorized Help	18	2862	December 11, 2020

Which client support tls-alpn challenge?

Related topics