Nginx introduces native support for ACME protocol (blog.nginx.org)

Article summary

NGINX has introduced native support for the ACME protocol, allowing for automated SSL/TLS certificate management. The implementation provides a new module, ngx_http_acme_module, which enables users to request, install, and renew certificates directly from the NGINX configuration. This feature aims to simplify and enhance the overall SSL/TLS certificate management process. The native support for ACME is available as a Rust-based dynamic module for both NGINX Open Source and NGINX Plus users.

Main themes

• ACME protocol support
• NGINX configuration
• SSL/TLS certificate management
• Automated certificate renewal
• Web server security

What commenters say

• The native ACME support in NGINX is a significant improvement, but some users are hesitant to switch from their current setup, such as using Certbot with NGINX.
• Caddy is considered a viable alternative to NGINX, with some users praising its ease of use, polished features, and better syntax.
• The lack of support for DNS-01 challenges in NGINX's ACME implementation is a limitation, making it difficult to obtain wildcard certificates.
• Some users have successfully used Caddy with plugins, such as the CloudFlare DNS plugin, to obtain wildcard certificates and automate certificate management.
• The complexity of NGINX's configuration, split into separate modules, is seen as a drawback compared to Caddy's more coherent configuration approach.
• Traefik is also considered a powerful tool, but its setup and learning curve are steeper than Caddy's, and it may use more resources and be slower.
• The desync problem in NGINX is a concern for some users, who have switched to Caddy due to the lack of clear information on how to configure NGINX to prevent such attacks.
• Apache has had ACME support since 2018, but it is not widely discussed or used, and some users are unaware of its existence.