add autotls blog post #137

2color · 2024-12-20T13:14:24Z

TODO before merging

feat: add AutoTLS example go-libp2p#3103
Update publish date

src/_blog/aut-tls.md

Co-authored-by: Marcin Rataj <lidel@lidel.org>

guillaumemichel

Great post! A few nits:

src/_blog/aut-tls.md

Co-authored-by: Guillaume Michel <guillaumemichel@users.noreply.github.com>

src/_blog/aut-tls.md

mishmosh

Excited for this to go live. Added a few comments with a lens towards using this for browser advocacy and drawing in new users, and 2 small typos.

src/_blog/aut-tls.md

mishmosh · 2025-01-16T18:19:26Z

src/_blog/aut-tls.md

+
+[Interplanetary Shipyard](https://blog.ipfs.tech/shipyard-hello-world/) is excited to announce [AutoTLS](https://registration.libp2p.direct/), a new service that automates the issuance of Let's Encrypt wildcard TLS certificates for libp2p nodes.
+
+This is a major leap for the libp2p ecosystem, because it allows connectivity between browsers and libp2p nodes using Secure WebSockets, opening up a new class of use cases for libp2p that were previously cumbersome.


Would be great to include 2 marketing/advocacy points here:

Would be great to get more specific about "new class of use cases" so devs who aren't yet libp2p users can more easily identify "oh, that sounds like me", e.g. "making it easier than ever to build peer-to-peer web applications".

Something about how this is an in-between step while we're also working with groups like Igalia to expand native browser support, which would be even better.

cc @lidel @aschmahmann

Two obvious and known use case I'm thinking about:

Direct retrieval, e.g. less reliance on recursive gateways in IPFS land. Another way to frame this: "quicker time to self publishing content on the web"

Browser based light clients for blockchains. By being able to connect to Ethereum consensus nodes and any other libp2p based blockchain means you can in theory forgo paid/centralized RPC endpoints and build much more decentralised light nodes.

Something about how this is an in-between step while we're also working with groups like Igalia to expand native browser support, which would be even better.

What do you mean by native browser support? As far as I'm aware it's Igalia is working on fixing WebTransport in Chrome and working on custom protocol handlers that could be bound to service workers from extension. ~~I'll add to add something about how WebTransport is much better designed for this since it supports self-signed certificates, less round trips, and avoid double encryption.~~

mishmosh · 2025-01-16T18:20:30Z

src/_blog/aut-tls.md

+
+## Conclusion
+
+Our long-standing goal at [Interplanetary Shipyard](https://blog.ipfs.tech/shipyard-hello-world/) is building a more resilient and participatory internet through decentralization, and we believe that the Web platform plays an important role in this. Therefore, we're excited to announce AutoTLS as a public good service operated by us.


"public good service..." --> maybe include for whom

mishmosh · 2025-01-16T18:22:19Z

src/_blog/aut-tls.md

+- [IPFS Desktop starting with v0.40.0](https://github.com/ipfs/ipfs-desktop/releases/tag/v0.40.0).
+- [js-libp2p](https://github.com/libp2p/js-libp2p/tree/main/packages/auto-tls) for Node.js.
+- [go-libp2p](https://github.com/libp2p/go-libp2p/tree/master/examples/autotls).
+


Here or else, include who/when it should not be used.

Co-authored-by: Mosh <1306020+mishmosh@users.noreply.github.com>

github-actions · 2025-01-17T14:16:43Z

src/_blog/aut-tls.md

+
+Recent investments in [WebTransport](https://connectivity.libp2p.io/#webtransport) and [WebRTC](https://connectivity.libp2p.io/#webrtc) helped circumvent this problem, by removing the need for CA-signed TLS certificate, but they have their own drawbacks outlined below.
+
+Experience has shown that WebSockets are still the most common and reliable way to establish a bi-directional streaming connection from a browser. That's not to say that WebSockets are perfect. Most notably, in libp2p, [Secure WebSockets require 6 round trips to establish a connection](https://connectivity.libp2p.io/#websocket?tab=websocket-in-libp2p). By comparison, [WebTransport requires 3 round trips](https://connectivity.libp2p.io/#webtransport?tab=webtransport-in-libp2p), which is why we believe WebTransport is the future of browser-node connectivity.


[LanguageTool] _{reported by reviewdog 🐶}
This word is normally spelled as one. (EN_COMPOUNDS_BI_DIRECTIONAL)
Suggestions: bidirectional
Rule: https://community.languagetool.org/rule/show/EN_COMPOUNDS_BI_DIRECTIONAL?lang=en-US
Category: MISC

github-actions · 2025-01-17T14:16:43Z

src/_blog/aut-tls.md

+
+### AutoTLS DNS-01 challenge broker
+
+1. To kick start the AutoTLS process, your libp2p node requests a TLS certificate for `*.<PeerID>.libp2p.direct` from Let's Encrypt. To which Let's Encrypt responds with a challenge to prove it controls that domain.


[LanguageTool] _{reported by reviewdog 🐶}
The word “kick-start” is spelled with a hyphen. (KICK_START_HYPHEN[1])
Suggestions: kick-start
URL: https://languagetool.org/insights/post/hyphen/#compound-nouns-with-and-without-hyphens
Rule: https://community.languagetool.org/rule/show/KICK_START_HYPHEN?lang=en-US&subId=1
Category: GRAMMAR

github-actions · 2025-01-17T14:16:43Z

src/_blog/aut-tls.md

+
+[Two years ago, the libp2p project bet on the promise of WebTransport](https://blog.libp2p.io/2022-12-19-libp2p-webtransport/) and it's been a bumpy road.
+
+WebTransport has a lot of promise. It's a modern browser protocol based on QUIC (which we already heavily rely on in libp2p), which allows bi-directional streaming communication with many modern improvements over WebSockets. Most notably:


[LanguageTool] _{reported by reviewdog 🐶}
This word is normally spelled as one. (EN_COMPOUNDS_BI_DIRECTIONAL)
Suggestions: bidirectional
Rule: https://community.languagetool.org/rule/show/EN_COMPOUNDS_BI_DIRECTIONAL?lang=en-US
Category: MISC

github-actions · 2025-01-17T14:16:43Z

src/_blog/aut-tls.md

+
+[WebRTC-Direct](https://github.com/libp2p/specs/blob/master/webrtc/webrtc-direct.md) is an approach using WebRTC to allow browser-to-node communication. It's unique in that it doesn't require SDP signaling, and saves the round trips by constructing the SDP from the information in the webrtc-direct multiaddr (a technique called "SDP munging"). Moreover, WebRTC, doesn't require a domain name and CA-signed TLS certificate.
+
+However, there are a number drawbacks to WebRTC:


[LanguageTool] _{reported by reviewdog 🐶}
Did you mean “number of”? (A_NUMBER_NNS[1])
Suggestions: number of
Rule: https://community.languagetool.org/rule/show/A_NUMBER_NNS?lang=en-US&subId=1
Category: GRAMMAR

github-actions · 2025-01-17T14:16:43Z

src/_blog/aut-tls.md

+
+## Origins vs. PeerIDs
+
+The Web security model is anchored to domain names (origins). Moreover, browsers require TLS certificates to be signed by a certificate authority (CA) so as to ensure that the entity requesting a certificate owns the domain name. The role of certificate authorities is to verify that the entity requesting a certificate owns the domain name.


[LanguageTool] _{reported by reviewdog 🐶}
‘So as to’ expresses purpose and is used in formal texts. Consider using “to”. (SO_AS_TO[1])
Suggestions: to
URL: https://languagetool.org/insights/post/synonyms-of-in-order-to/
Rule: https://community.languagetool.org/rule/show/SO_AS_TO?lang=en-US&subId=1
Category: REDUNDANCY

add autotls blog post

6276754

2color requested review from cewood and lidel December 20, 2024 13:24

2color assigned aschmahmann and unassigned aschmahmann Dec 20, 2024

2color requested a review from aschmahmann December 20, 2024 13:24

refine conclusion

4b2dc99

lidel reviewed Dec 23, 2024

View reviewed changes

2color and others added 2 commits December 24, 2024 10:40

Apply suggestions from code review

1f8ad4d

Co-authored-by: Marcin Rataj <lidel@lidel.org>

Apply suggestions from code review

2468df6

Co-authored-by: Marcin Rataj <lidel@lidel.org>

2color requested a review from guillaumemichel January 8, 2025 14:22

guillaumemichel approved these changes Jan 15, 2025

View reviewed changes

src/_blog/aut-tls.md Outdated Show resolved Hide resolved

src/_blog/aut-tls.md Outdated Show resolved Hide resolved

src/_blog/aut-tls.md Outdated Show resolved Hide resolved

src/_blog/aut-tls.md Show resolved Hide resolved

2color and others added 3 commits January 16, 2025 11:56

Apply suggestions from code review

9032c5d

Co-authored-by: Guillaume Michel <guillaumemichel@users.noreply.github.com>

add note about base36 encoding of the PeerID

87c8ebf

add mention of dns autotls multiaddr

6f925a8

mishmosh reviewed Jan 16, 2025

View reviewed changes

src/_blog/aut-tls.md Outdated Show resolved Hide resolved

mishmosh reviewed Jan 16, 2025

View reviewed changes

Apply suggestions from code review

a0ee02b

Co-authored-by: Mosh <1306020+mishmosh@users.noreply.github.com>

github-actions bot reviewed Jan 17, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add autotls blog post #137

add autotls blog post #137

2color commented Dec 20, 2024

guillaumemichel left a comment

mishmosh left a comment

mishmosh Jan 16, 2025

2color Jan 17, 2025 •

edited

Loading

mishmosh Jan 16, 2025

mishmosh Jan 16, 2025

github-actions bot Jan 17, 2025

github-actions bot Jan 17, 2025

github-actions bot Jan 17, 2025

github-actions bot Jan 17, 2025

github-actions bot Jan 17, 2025


		[Interplanetary Shipyard](https://blog.ipfs.tech/shipyard-hello-world/) is excited to announce [AutoTLS](https://registration.libp2p.direct/), a new service that automates the issuance of Let's Encrypt wildcard TLS certificates for libp2p nodes.

		This is a major leap for the libp2p ecosystem, because it allows connectivity between browsers and libp2p nodes using Secure WebSockets, opening up a new class of use cases for libp2p that were previously cumbersome.


		## Conclusion

		Our long-standing goal at [Interplanetary Shipyard](https://blog.ipfs.tech/shipyard-hello-world/) is building a more resilient and participatory internet through decentralization, and we believe that the Web platform plays an important role in this. Therefore, we're excited to announce AutoTLS as a public good service operated by us.


		Recent investments in [WebTransport](https://connectivity.libp2p.io/#webtransport) and [WebRTC](https://connectivity.libp2p.io/#webrtc) helped circumvent this problem, by removing the need for CA-signed TLS certificate, but they have their own drawbacks outlined below.

		Experience has shown that WebSockets are still the most common and reliable way to establish a bi-directional streaming connection from a browser. That's not to say that WebSockets are perfect. Most notably, in libp2p, [Secure WebSockets require 6 round trips to establish a connection](https://connectivity.libp2p.io/#websocket?tab=websocket-in-libp2p). By comparison, [WebTransport requires 3 round trips](https://connectivity.libp2p.io/#webtransport?tab=webtransport-in-libp2p), which is why we believe WebTransport is the future of browser-node connectivity.


		### AutoTLS DNS-01 challenge broker

		1. To kick start the AutoTLS process, your libp2p node requests a TLS certificate for `*.<PeerID>.libp2p.direct` from Let's Encrypt. To which Let's Encrypt responds with a challenge to prove it controls that domain.


		[Two years ago, the libp2p project bet on the promise of WebTransport](https://blog.libp2p.io/2022-12-19-libp2p-webtransport/) and it's been a bumpy road.

		WebTransport has a lot of promise. It's a modern browser protocol based on QUIC (which we already heavily rely on in libp2p), which allows bi-directional streaming communication with many modern improvements over WebSockets. Most notably:


		[WebRTC-Direct](https://github.com/libp2p/specs/blob/master/webrtc/webrtc-direct.md) is an approach using WebRTC to allow browser-to-node communication. It's unique in that it doesn't require SDP signaling, and saves the round trips by constructing the SDP from the information in the webrtc-direct multiaddr (a technique called "SDP munging"). Moreover, WebRTC, doesn't require a domain name and CA-signed TLS certificate.

		However, there are a number drawbacks to WebRTC:


		## Origins vs. PeerIDs

		The Web security model is anchored to domain names (origins). Moreover, browsers require TLS certificates to be signed by a certificate authority (CA) so as to ensure that the entity requesting a certificate owns the domain name. The role of certificate authorities is to verify that the entity requesting a certificate owns the domain name.

add autotls blog post #137

Are you sure you want to change the base?

add autotls blog post #137

Conversation

2color commented Dec 20, 2024

TODO before merging

guillaumemichel left a comment

Choose a reason for hiding this comment

mishmosh left a comment

Choose a reason for hiding this comment

mishmosh Jan 16, 2025

Choose a reason for hiding this comment

2color Jan 17, 2025 • edited Loading

Choose a reason for hiding this comment

mishmosh Jan 16, 2025

Choose a reason for hiding this comment

mishmosh Jan 16, 2025

Choose a reason for hiding this comment

github-actions bot Jan 17, 2025

Choose a reason for hiding this comment

github-actions bot Jan 17, 2025

Choose a reason for hiding this comment

github-actions bot Jan 17, 2025

Choose a reason for hiding this comment

github-actions bot Jan 17, 2025

Choose a reason for hiding this comment

github-actions bot Jan 17, 2025

Choose a reason for hiding this comment

2color Jan 17, 2025 •

edited

Loading