Install Letsencrypt cert by default #798

New Issue

2026-10-05T04:45:15+02:00

adam commented

2026-10-05 04:45:15 +02:00

Why not have ZNC generate and maintain a letsencrypt certificate on its own.

Check if cert exists on startup and if not, make one, renew it as needed.

Maybe have it as a setting or prompt in makeconf for the hostname. Test generation using staging, if success, retry on the main server?

Maybe even have ACME server URL be configurable.

Example of software already doing this: https://caddyserver.com

Why not have ZNC generate and maintain a letsencrypt certificate on its own. Check if cert exists on startup and if not, make one, renew it as needed. Maybe have it as a setting or prompt in makeconf for the hostname. Test generation using staging, if success, retry on the main server? Maybe even have ACME server URL be configurable. Example of software already doing this: https://caddyserver.com

adam closed this issue

2026-10-05 04:45:15 +02:00

adam commented

2026-10-05 04:45:16 +02:00

Not all ZNC users/hosters have domains. Isn't that needed for a letsencrypt certificate to function?

Can't letsencrypt certification generation and renewal already be automated in a number of fashions?

Not all ZNC users/hosters have domains. Isn't that needed for a letsencrypt certificate to function? Can't letsencrypt certification generation and renewal already be automated in a number of fashions?

adam commented

2026-10-05 04:45:17 +02:00

@magnum7385 absolutely and in that case a prompt for hostname can have the user type an IP or a nonstandard webadmin port, which disables this and makes a self-signed cert.

It can be automated, but it for example requires a frontend proxy to the webadmin, or run on a different port and then also reloading/restarting ZNC when the cert is changed.

Doing this reduces the barrier to entry to almost zero for users.

@magnum7385 absolutely and in that case a prompt for hostname can have the user type an IP or a nonstandard webadmin port, which disables this and makes a self-signed cert. It can be automated, but it for example requires a frontend proxy to the webadmin, or run on a different port and then also reloading/restarting ZNC when the cert is changed. Doing this reduces the barrier to entry to almost zero for users.

adam commented

2026-10-05 04:45:17 +02:00

User 'empty_string' on irc pointed me to a fatal flaw, CA/Browser Forum mandates the following:

Authorized Port: One of the following ports: 80 (http), 443 (http), 115 (sftp), 25 (smtp), 22 (ssh).

Which would require that ZNC run as root, or somehow get permission to use privileged ports.

User 'empty_string' on irc pointed me to a fatal flaw, CA/Browser Forum mandates the following: > Authorized Port: One of the following ports: 80 (http), 443 (http), 115 (sftp), 25 (smtp), 22 (ssh). Which would require that ZNC run as root, or somehow get permission to use privileged ports.

adam commented

2026-10-05 04:45:18 +02:00

An option to enable a letsencrypt cert that you could turn on and off keeping up to date would be wonderful.

An option to enable a letsencrypt cert that you could turn on and off keeping up to date would be wonderful.

adam commented

2026-10-05 04:45:19 +02:00

In my case, even running the ZNC server as root forever would be fine, since i run it inside a limited docker container that has static IPs routed/assigned to it and it has no permissions on the host machine.

I ofcourse accept that not everyone does so and allowing it to run as root 'willy nilly' is probably a bad idea, but maybe as an advanced option?
--run-as-root-yes-im-sure-let-me-shoot-myself-in-the-foot-if-i-want-to

In my case, even running the ZNC server as root forever would be fine, since i run it inside a limited docker container that has static IPs routed/assigned to it and it has no permissions on the host machine. I ofcourse accept that not everyone does so and allowing it to run as root 'willy nilly' is probably a bad idea, but maybe as an advanced option? `--run-as-root-yes-im-sure-let-me-shoot-myself-in-the-foot-if-i-want-to`

adam commented

2026-10-05 04:45:19 +02:00

Such advanced option actually exists already (check znc --help :P), but the requirement of specifying it doesn't make the barrier to entry zero.

ZNC docker image has a better chance to have ACME client preinstalled, but in case of docker it would be cleaner to run services in separate containers anyway, and there is a certbot image already.

Such advanced option actually exists already (check `znc --help` :P), but the requirement of specifying it doesn't make the barrier to entry zero. ZNC docker image has a better chance to have ACME client preinstalled, but in case of docker it would be cleaner to run services in separate containers anyway, and there is a [certbot](https://hub.docker.com/r/certbot/certbot/) image already.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#798