i want to use the client in asuswrt merlin, just because port 80 has been blocked by ISP. i can use acme.sh, but it seemed that this client doesn’t support tls-alpn. any suggestions? thanks a lot for help!

Related: So how are we bringing TLS-ALPN to the masses? TLS-SNI it’s not likely to be something that individual users will be using, at least not for a while. These seem to support TLS-ALPN-01 (updated 2020-03-13): ACME4J: tls-alpn-01 Challenge - acme4j ansible: acme_certificate – Create SSL/TLS certificates with the ACME protocol — Ansible Documentation Lego: GitHub - go-acme/lego: Let's Encrypt/ACME client and library written in Go Golang/x/acme: acme package - golang.org/x/crypto/acme - Go Packages dehydrated https://github.com/lukas2511/dehydrated/blob/master/docs/tls-alpn.md Net::ACME2 Net::ACME2 - Client logic for the ACME (Let's Encrypt) protocol - metacpan.org Acme.sh GitHub - acmesh-official/acme.sh: A pure Unix shell script implementing ACME client protocol (Acme.sh supports tls-alpn mode and buypass.com CA now) Apache mod_md (support was added in the v1.99.0 release: Release mod_md v1.99.0 · icing/mod_md · GitHub) Lets-proxy2 GitHub - rekby/lets-proxy2: Reverse proxy with automatically obtains TLS certificates from Let's Encrypt win-acme https://www.win-acme.com lua-resty-acme GitHub - fffonion/lua-resty-acme: Automatic Let's Encrypt certificate serving and Lua implementation of ACMEv2 procotol uacme GitHub - ndilieto/uacme: ACMEv2 client written in plain C with minimal dependencies Web servers compatible with TLS-ALPN-01: Apache2 (EXPERIMENTAL with mod_md) nginx (with dehydrated): https://github.com/lukas2511/dehydrated/blob/master/docs/tls-alpn.md#example-nginx-config Lightttpd 1.4.53 (with dehydrated): HowToSimpleSSL - Lighttpd - lighty labs

i see, thanks a lot. then can i renew a certification by some client through port 443?

(2018-11-19: moved client list to first post) [image] saccleo: port 80 has been blocked by ISP Another solution would be a DNS challenge

[image] tdelmas: These seams to support TLS-ALPN-01: Two other ACME clients I know have TLS-ALPN-01 support: Lego: GitHub - go-acme/lego: Let's Encrypt/ACME client and library written in Go Golang/x/acme: acme package - golang.org/x/crypto/acme - Go Packages

Thanks for replies, I’ll try them.

lukas2511/dehydrated/blob/master/docs/tls-alpn.md # TLS-ALPN-01 With `tls-alpn-01`-type verification Let's Encrypt (or the ACME-protocol in general) is checking if you are in control of a domain by accessing your webserver using a custom ALPN and expecting a specially crafted TLS certificate containing a verification token. It will do that for any (sub-)domain you want to sign a certificate for. Dehydrated generates the required verification certificates, but the delivery is out of its scope. ### Example nginx config On an nginx tcp load-balancer you can use the `ssl_preread` module to map a different port for acme-tls requests than for e.g. HTTP/2 or HTTP/1.1 requests. Your config should look something like this: ```nginx stream { server { map $ssl_preread_alpn_protocols $tls_port { ~\bacme-tls/1\b 10443; This file has been truncated. show original

Net::ACME2 supports it as well.

i use lego to get right certifications

(I reopened the subject so answers can be posted to ask to update the list)

@tdelmas Apache mod_md has added experimental support for TLS-ALPN-01 in the v1.99.0 release: https://github.com/icing/mod_md/releases/tag/v1.99.0

Which client support tls-alpn challenge?

Help

ndilieto March 2, 2020, 7:02am 19

Just to add that ualpn should make TLS-ALPN-01 work with any webserver, without downtime.

Topic		Replies	Views
So how are we bringing TLS-ALPN to the masses? Client dev	16	14199	June 20, 2018
Tls-alpn-01 support in certbot Client dev	3	8121	January 30, 2019
TLS-ALPN-01 support Site Feedback	1	1642	August 14, 2021
How to renew for Dynamic DNS host with no port 80? Issuance Tech	7	2896	January 7, 2019
Tls-alpn-01 with acme4j -> unauthorized Help	18	3040	December 11, 2020

Which client support tls-alpn challenge?

Related topics