TLS built-in out of the box

[Q-Droid 1014]

Is it time to explore this either in Emby core or as a plug-in if possible?

https://letsencrypt.org/2026/01/15/6day-and-ip-general-availability

Quote

Short-lived and IP address certificates are now generally available from Let’s Encrypt. These certificates are valid for 160 hours, just over six days. In order to get a short-lived certificate subscribers simply need to select the ‘shortlived’ certificate profile in their ACME client.

 

[Neminem 1640]

That sounds interesting, not that I need it.

But is sounds a lot like DDNS + Cert.

 

[Q-Droid 1014]

18 minutes ago, Neminem said:

That sounds interesting, not that I need it.

But is sounds a lot like DDNS + Cert.

 

These are IP based certificates which eliminate the need for domains.

I should rephrase: They eliminate the requirement of a domain name. Domain names still good but not needed.

 

 

Edited March 30 by Q-Droid

[Neminem 1640]

That sound really nice .

Thanks for the explanation

[Apotropaic 62]

Interesting decision from Letsencrypt, I'm usually all-in when it comes to encrypting everything but surely this is just enabling bad actors from also enabling on the fly certs for whatever they're up to!?

I know they're not the first to do this, but they are free and support automation. I can see organisations just blanket blacklisting their certs to deal with this.

As for projects like emby it sounds pretty good, unless of course your IP is very dynamic

[Q-Droid 1014]

Organizations that are concerned about these IP based certs can create policies to restrict to Domain Validation (DV) or higher. They wouldn't have to blacklist the CA, ISRG in this instance. Even DV certs don't add that much protection since anyone can get a subdomain with a DDNS service or even free Cloudflare.

For Emby users I see this as an option for those who rely on Emby Connect, don't have a domain and would like to benefit from end-to-end TLS/HTTPS without having to learn or follow the usual path to HTTPS.

As for the rest I do see how this could open the door for bad actors against whom the only safeguard currently in place is a bad cert error in a browser or auto HTTPS failing to connect. But with free domains or options like Cloudflare some are likely presenting "valid" endpoints already.

 

[darkassassin07 676]

This would certainly improve security for those that don't want to setup a domain. There's been quite a few threads lately revealing servers that are publicly exposed with only http...

[brothom 211]

I'd be much more interested in seeing "Certify the Web" being implemented as it's a replacement for certbot (and I think also offer this feature?)

[AV1Opus 5]

Well, it's a Windows-only software and you can configure it yourself.

[Q-Droid 1014]

ACME .Net libraries and tools are available for developers to build or integrate ACME clients. A feature built into Emby to request, deploy and renew TLS certs could solve a lot of headaches. Granted it could create some too though overall I would say it lands on the positive side.

 

Edited March 31 by Q-Droid