Company
Date Published
Author
Vincent Le Goff
Word count
890
Language
English
Hacker News points
None

Summary

In the realm of Dev Portals, providing users the ability to utilize their own domain is a significant step towards fully customized portals. This functionality was achieved by leveraging the open-source ACME plugin, which integrates with Let's Encrypt to manage TLS certificates dynamically. However, the original plugin had limitations, including a restrictive list of top-level domains and the potential for abuse through the issuance of certificates using IPv4 addresses. To address these, modifications were made to disable the restrictive allow-list and introduce a check against using IPv4 as a certificate common name. Additionally, to prevent malicious misuse by flooding the certificate provider with requests, a custom plugin was developed to verify domain existence in the Konnect portal database before certificate provisioning. This custom plugin runs with a higher priority than the ACME plugin during the TLS connection negotiation phase, ensuring only legitimate domains receive certificates. Consequently, administrators need only add a CNAME in the DNS and enter the custom domain in the portal settings to enable this feature, making custom portals accessible once DNS settings are propagated.