When you go to just about any web site, your browser sets up an encrypted connection between you and the server so that anything you do on the web site can't be observed by sniffing the traffic.

Let's Encrypt is a suite of software developed by the Electronic Frontier Foundation to bring this security to anyone with a website (or anyone with a webservice, really). What Let's Encrypt provides you is a fully trusted certificate chain. As a result of making the certificate free for anyone (and I mean anyone) can use, the certificate is only valid for 90 days.

You can purchase a trusted certificate that lasts longer but renewal is so easy that unless you need a higher "reputation" cert, it's not worth it. Fun fact: cia.gov uses LE certificates!

Not sure what KanIDM is but they are probably having you use an LE certificate to create a secure connection between clients and servers. It's free and pretty easy to set up.

Optionally, if you're technically savvy, you can set up your own Certificate Authority and distribute it on your own. This gives you full control over your certificate linage but my guess is you won't get the benefits of it.

Use Caddy as a web server and forget about setting up certificates forever. This masterpiece will take care of it.

Puts the S in HTTPS. Free. Get an ACME client for your service. https://acmeclients.com

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

[Thread #185 for this sub, first seen 4th Oct 2023, 16:45] [FAQ] [Full list] [Contact] [Source code]

A reverse proxy like nginx can automatically implement it for you. Probably the easiest way of generating and using your own SSL with let's encrypt is a reverse proxy.

If you own a domain name, you can point that domain name at your IP, and Let’s Encrypt’s cryptbot program can help you get a free TLS certificate to host all your stuff over https.

With certain setups it can be renewed automatically, otherwise the certificate lasts 90 days, and renewal only takes a few minutes.

Its a internet service/company that wants to make HTTPS available for everyone. Because of security reasons. You can create an Lets Encrypt Account, Register your servers DNS in any DNS service out there and then link your server to your Lets Encrypt Account. Then you can get SSL cert for your DNS Record/your server. I think it is valid for 90 days. You can renew the cert when there are 30 days left i think. So its free SSL for your webserver connection. This is a realy basic explanation but i think to understand what it does its enough ;) Hope this helps - If not, feel free to ask more :)

Edit: your webserver must be accessible from the www

I'm going to cast another vote for a reverse proxy, such as NginxProxyManager. It's really easy to set everything up, and they're usually very easy to run in Docker/Podman.

One thing to note: if you end up with a domain with mandatory HSTS, you'll have to use DNS-based certificate generation rather than HTTP based, since unencrypted HTTP is blocked (chicken/egg problem to get HTTPS working). It's not hard, but you have to be aware of that limitation.

I've been using it for a few years (on a mail server and some websites) and am really happy. It's worth looking into.

I don't know KanIDM specifically so take this with a grain of salt.

Let's Encrypt only provides server certificates. The kind used to secure a connection (HTTPS, IMAPS, etc). KanIDM might require a Certificate Authority (CA) certificate to issue Client Certificates (used for authentication like MIME-S, WPA Enterprise, etc). Let's Encrypt cannot be used for this purpose.