Secure Self-Service Custom Domains for Dev Portals

In the realm of Dev Portals, providing users the ability to utilize their own domain is a significant step towards fully customized portals. This functionality was achieved by leveraging the open-source ACME plugin, which integrates with Let's Encrypt to manage TLS certificates dynamically. However, the original plugin had limitations, including a restrictive list of top-level domains and the potential for abuse through the issuance of certificates using IPv4 addresses. To address these, modifications were made to disable the restrictive allow-list and introduce a check against using IPv4 as a certificate common name. Additionally, to prevent malicious misuse by flooding the certificate provider with requests, a custom plugin was developed to verify domain existence in the Konnect portal database before certificate provisioning. This custom plugin runs with a higher priority than the ACME plugin during the TLS connection negotiation phase, ensuring only legitimate domains receive certificates. Consequently, administrators need only add a CNAME in the DNS and enter the custom domain in the portal settings to enable this feature, making custom portals accessible once DNS settings are propagated.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.