Repository navigation
SSL - LetsEncrypt the Console Proxy #3141
Description
ISSUE TYPE
- Feature Idea
COMPONENT NAME
Console Proxy VM
CLOUDSTACK VERSION
4.11.1+
CONFIGURATION
LetsEncrypt the Console Proxy
Many new applications are now integrating letsencrypt. This could replace the old retired realhostip.com DNS resolver . Noone would need to muck around with certs again on the console proxy.
SUMMARY
New Global Option For Letsencrypt enable on console proxy. Letsencrypt domain name option for letsencrypt ssl auto renew
Activity
DaanHoogland commentedon Jan 29, 2020
any plans for this @asender ?
DaanHoogland commentedon Dec 15, 2020
@davidjumani @weizhouapache can you advice how this would impact novnc? it seems not relevant to the type of console but i am not sure.
weizhouapache commentedon Dec 15, 2020
@DaanHoogland it provides a default certificate (like old realhostip.com) to systemvms. It is an enhancement . ajax/novnc console will not be impacted.
4 remaining items
yadvr commentedon Aug 17, 2022
My email/suggestion was to use RFC1918 networks for both public and management networks, of course this won't work for your use-case. You can use the traditional approach to setup/upload certificates (until something like this feature is fully automated).
daviftorres commentedon Sep 4, 2025
Dear @asender,
I’d like to apologise for having a different view on the certificate strategy for the Console Proxy (and System VMs in general).
Since System VMs are ephemeral, they would request new certificates every time they are redeployed. This could quickly hit Let’s Encrypt rate limits (https://letsencrypt.org/docs/rate-limits/).
A better approach is to use a dedicated instance (or even a container) to request certificates, for example a wildcard via DNS challenge, about 30 days before expiry. The instance can then push the certs to CloudStack for use by the System VMs.
If you’re interested, I can also share how we set this up with HashiCorp Vault to securely store certificates and allow consumers to fetch only the ones they’re permitted to use.