HTTPS and Let's Encrypt

• Introduction
• Configuring HTTPS in HTTPServer
  • Manual Configuration
  • Using AutoCertManager
• AutoCertManager Configuration

Introduction

Easegress offers both manual and automated approach to manage HTTPS certificates. The automated method is using business controller AutoCertManager. This tutorial will guide you through setting up HTTPS in HTTPServer and configuring AutoCertManager for certificate management with Let's Encrypt.

Configuring HTTPS in HTTPServer

To implement HTTPS in HTTPServer, you have two options: manually providing certificates and keys, or using AutoCertManager for automated certificate management.

Manual Configuration

For manual configuration, you need to set https to true and provide your certificates and keys.

name: demo
kind: HTTPServer
https: true
autoCert: false
certs:
  cert1: <public-key-data>
  cert2: <public-key-data>
keys:
  cert1: <private-key-data>
  cert2: <private-key-data>
...

Using AutoCertManager

If you prefer automated management with Let's Encrypt, set autoCert to true. This will utilize the AutoCertManager.

name: demo
kind: HTTPServer
https: true
autoCert: true
...

AutoCertManager Configuration

AutoCertManager is a business controller, which is more special than others. Because there can be at most one instance of AutoCerManager. It manages HTTPS certificates and handles challenge traffic from Let's Encrypt.

kind: AutoCertManager
name: AutoCertManager
email: someone@megaease.com
directoryURL: https://acme-v02.api.letsencrypt.org/directory
renewBefore: 720h
enableHTTP01: true
enableTLSALPN01: true
enableDNS01: true
domains:
  - name: "*.megaease.com"
    dnsProvider:
      name: dnspod
      zone: megaease.com
      apiToken: <token value>

Explanation of Fields:

• email: Email address for Let's Encrypt registration.
• directoryURL: CA directory URL (default: Let's Encrypt official one).
• renewBefore: Time before expiry to renew the certificate.
• enableHTTP01, enableTLSALPN01, enableDNS01: Challenge types to enable.
• domains: Domains to manage, along with their DNS provider configurations.

Assuming we have saved the config in acm.yaml, we could use this command to update global AutoCertManager.

$ egctl apply -f acm.aml

See more details about AutoCertManager in here.