I have been listening to groove salad since high school. I was happy to run into the team at defcon and express my gratitude. Also, if you love the station, don't forget to donate/support[1] them.

1. https://somafm.com/support/

I had a similar issue with .dev tld and getting emails from Walmart.

I went to business.apple.com and it looks like they ask for a business id. What did you put in?

I think any ssn should work. They come from the same pool

This will not cover all sites[1].

1. https://support.cloudflare.com/hc/en-us/articles/202320534-C...

Huh TIL. Good call!

Yup, same comment in the YouTube[1] video at :33.

1. https://youtu.be/sMvrx8exfek

I think you mean SAN instead of SNI. SNI is like host headers for TLS connections, while SAN on certs allow you have to very valid for multiple names.

Look like http2 support for cloudfront is coming soon[1].

https://forums.aws.amazon.com/message.jspa?messageID=708630#...

Whoa, that's awesome. I'm familiar with that forum thread (haha) but I didn't realize there'd been a response on it from an AWS employee just in the last couple of weeks.

Can you elaborate on why you came to this conclusion? I am able to do multipart uploads via cloudfront to s3.

I use Let's Encrypt DNS validation. This does not require you to run anything on your server. You just need to have a way to distribute cert to your servers.

can you explain this ? I'm trying to bake letsencrypt certificates in my docker images and I am trying to figure out a way around the race condition (nginx needs a certificate to run <-> certificate needs nginx to run).

Here's one approach: https://github.com/DanielDent/docker-nginx-ssl-proxy

I use a temporary self-signed keypair, which then gets replaced when the certificate is issued.

How about storing the letsencrypt certificates in a data-container/locally on the host and mapping those files to the nginx container when you start it?

For the very first time, you can use let's encrypt's manual verification process, but then have the let's encrypt client set up to renew certs automatically (possibly even from a separate container) using same data file mappings.

which is why im preferring to spend 10$ on a certificate instead (or rather 85$ for a wildcard).

You can obtain a certificate by running let's encrypt's docker image, which seems to contain a python web server just to do the validation.

cannot run a docker inside a docker. the problem is not running a webserver, the problem is the race condition which needs to be solved when docker starts up.

As a totally-naive-to-your-problem-particulars and totally-hacky suggestion, why not start nginx with a starter cert, then mv the new cert into position and reload nginx?

exactly what I did - but then I bought a certificate from rapidssl for 10 bucks...

Have an instance with plain-text http running only the Lets Encrypt challenge. Make an explicit rule for it on your load balancer, and deploy it first.

SNI only distributions don't cost $600/month.