4 ms·

I am beginning to wonder how much effect Let's Encrypt will really have on wide TLS deployment. A very large portion of the web is stuck at shared hosting servi

I am beginning to wonder how much effect Let's Encrypt will really have on wide TLS deployment. A very large portion of the web is stuck at shared hosting services, such as Go Daddy, Lunarpages, et al. These services generally charge for TLS hosting, and due to the 90-day issuance on Let's Encrypt certificates it seems somewhat infeasible to use their certificates on shared hosts which offer very limited (if any) shell access.

atmosx 11y ago
A VPS costs 5 bucks on DO and I've seen (can't remember where) a 3 USD/month offering. So it's rather cheap to move away from shared hosting nowadays. For me Let's Encrypt came out at the right time. They said they will automate the 90-day renewal process.
- Diamons 11y ago
  Side question, does anyone actually enjoy running a VPS? Between managing the sites on it, you have to maintain the VPS, keep it up to date, its prone to security bugs and flaws, etc. Am I missing something here? I remember setting up multiple VPSes on Linode / DO and it was always a painful process of installing the OS, installing the whole stack, configuring everything, setting up users / roles, firewalls, etc. On top of that, whereas on a shared host i click a button and host a second domain, with a VPS I have to SSH in and manually edit server files. But everyone always recommends running a VPS so I can't help but imagine I've either missed some magical tool that makes running a VPS a snap or it's just not a realistic solution for most people.
  - xienze 11y ago
    I don't think it's a question of "enjoy" versus "need". If you just doing some static hosting with perhaps PHP, sure, go with shared hosting. The second you need to run your own Java server, Go server, etc. you're in VPS territory.
  - aianus 11y ago
    > installing the OS, installing the whole stack, configuring everything, setting up users / roles, firewalls, etc. > SSH in and manually edit server files. Docker solves almost all those problems. Comes with its own complexities, though.
  - eCa 11y ago
    Automation. I recently found Rex[1] and will give it a go to see if it eases some of the pains. [1] http://www.rexify.org/ http://www.rexify.org/
  - aeorgnoieang 11y ago
    I know DO for instance has ['projects'](https://www.digitalocean.com/community/projects https://www.digitalocean.com/community/projects) – "apps, wrappers, and integrations created by our developer community using the DigitalOcean API" – so you don't necessarily have to setup everything yourself. But if you're configuring multiple nodes that are similar or the same you should definitely be using images. Setup one node, create an image of it, and then create new nodes from the image.
  - geerlingguy 11y ago
    On a basic level, shell scripts to do the basic config work in a pinch. But if you can learn the basics of Ansible, setting up a new VM can take just a few minutes and not be painful at all. It's quicker for me to add a new VM and apply a few Ansible roles I've written for a new client site/app than to log into some shared hosting provider and click through their UI to do the same.
    - voltagex_ 11y ago
      Have you got any hints on learning Ansible? I've tried but I find YAML quite tedious to write - I'm more likely to reach for shell scripts. I'd also like to integrate it with https://github.com/voltagex/junkcode/blob/master/Python/spotprices/spotprices.py https://github.com/voltagex/junkcode/blob/master/Python/spot... so I can do "least cost provisioning"
  - discreditable 11y ago
    I much prefer using NearlyFreeSpeech. I like being able to outsource the server management to them. Since my sites are static and largely cached by Cloudflare, I think I've paid them less than $10 for the last year's worth of service.
- xienze 11y ago
  I don't think cost is what's keeping people on shared hosting versus VPS. It's that there is a whole wide world of people just doing a little static hosting. They don't want, need, or know how to use a VPS.
  - jnbiche 11y ago
    In fact, I think most people on shared hosting are not hosting static sites, but rather sites based on one or more of the hundreds of PHP application frameworks out there (WordPress, PHPBB, Joomla, Drupal, Magento, MediaWiki, etc, etc.) Back when I used to do frequent freelancing for the type of client who used shared hosting, I don't think I met a single one who hosted static sites, even though for many of them static would have been more appropriate and far more secure and performant.
- dspillett 11y ago
  There are reasonable offerings for between 10 and 20 USD/year (from companies that are even likely to be around long enough for you to use the full year - there are cheaper still from the other sort of company) some with enough CPU+memory+disk space to be useful for more than static hosting too. Look at places like lowendtalk.com for such offers when they turn up.
- GigabyteCoin 11y ago
  >I've seen (can't remember where) a 3 USD/month offering. You're probably thinking of http://lowendbox.com/ http://lowendbox.com/
- sofaofthedamned 11y ago
  Let's Encrypt is brilliant and the web needs it but the tooling isn't quite there. For example with haproxy you need the entire chain and private key together, which I have to do manually. As the API is open it's doable - I may even do something myself. I can't wait until I have something that somebody else or I has written that, once the API is complete, you can stick in a cron job and does the concatenation and reloads haproxy/nginx/whatever. Until then the whole thing is beta. It's not even the monetary aspect - i'd happily pay for certs, but LE is so on the way to making it a devop as opposed to a finance/ops thing that it needs to be encouraged. Donation incoming...
bracewel 11y ago
Many hosting providers are choosing to integrate LE into their products directly so even if you don't get shell access you will still be able to get a cert. As far as I know both Plesk and cPanel are also working on official plugins for their software.
pfg 11y ago
That's a good point, domain registrars like GoDaddy generally don't make much on domains alone and focus on selling additional services like hosting packets (and SSL), where they probably make most of their money. However, most browser vendors are already making plans to phase out HTTP without TLS by only providing new features/APIs to HTTPS sites (and eventually by displaying http:// http:// as insecure in the UI). I think in the end this will force shared hosting providers to include domain-validated certificates (from e.g. letsencrypt) in their base packages for free. Instead, they would probably push OV and EV certs to make up for any revenue loss.
pilif 11y ago
I would imagine that shared hosting providers will just request the certificate for you in the future. Remember: This is about domain validated certs, so there's zero difference whether you request the certificate or whether your hoster does it for you.

atmosx 11y ago

A VPS costs 5 bucks on DO and I've seen (can't remember where) a 3 USD/month offering. So it's rather cheap to move away from shared hosting nowadays. For me Let's Encrypt came out at the right time. They said they will automate the 90-day renewal process.

Diamons 11y ago
Side question, does anyone actually enjoy running a VPS? Between managing the sites on it, you have to maintain the VPS, keep it up to date, its prone to security bugs and flaws, etc. Am I missing something here? I remember setting up multiple VPSes on Linode / DO and it was always a painful process of installing the OS, installing the whole stack, configuring everything, setting up users / roles, firewalls, etc. On top of that, whereas on a shared host i click a button and host a second domain, with a VPS I have to SSH in and manually edit server files. But everyone always recommends running a VPS so I can't help but imagine I've either missed some magical tool that makes running a VPS a snap or it's just not a realistic solution for most people.
- xienze 11y ago
  I don't think it's a question of "enjoy" versus "need". If you just doing some static hosting with perhaps PHP, sure, go with shared hosting. The second you need to run your own Java server, Go server, etc. you're in VPS territory.
- aianus 11y ago
  > installing the OS, installing the whole stack, configuring everything, setting up users / roles, firewalls, etc. > SSH in and manually edit server files. Docker solves almost all those problems. Comes with its own complexities, though.
- eCa 11y ago
  Automation. I recently found Rex[1] and will give it a go to see if it eases some of the pains. [1] http://www.rexify.org/ http://www.rexify.org/
- aeorgnoieang 11y ago
  I know DO for instance has ['projects'](https://www.digitalocean.com/community/projects https://www.digitalocean.com/community/projects) – "apps, wrappers, and integrations created by our developer community using the DigitalOcean API" – so you don't necessarily have to setup everything yourself. But if you're configuring multiple nodes that are similar or the same you should definitely be using images. Setup one node, create an image of it, and then create new nodes from the image.
- geerlingguy 11y ago
  On a basic level, shell scripts to do the basic config work in a pinch. But if you can learn the basics of Ansible, setting up a new VM can take just a few minutes and not be painful at all. It's quicker for me to add a new VM and apply a few Ansible roles I've written for a new client site/app than to log into some shared hosting provider and click through their UI to do the same.
  - voltagex_ 11y ago
    Have you got any hints on learning Ansible? I've tried but I find YAML quite tedious to write - I'm more likely to reach for shell scripts. I'd also like to integrate it with https://github.com/voltagex/junkcode/blob/master/Python/spotprices/spotprices.py https://github.com/voltagex/junkcode/blob/master/Python/spot... so I can do "least cost provisioning"
- discreditable 11y ago
  I much prefer using NearlyFreeSpeech. I like being able to outsource the server management to them. Since my sites are static and largely cached by Cloudflare, I think I've paid them less than $10 for the last year's worth of service.
xienze 11y ago
I don't think cost is what's keeping people on shared hosting versus VPS. It's that there is a whole wide world of people just doing a little static hosting. They don't want, need, or know how to use a VPS.
- jnbiche 11y ago
  In fact, I think most people on shared hosting are not hosting static sites, but rather sites based on one or more of the hundreds of PHP application frameworks out there (WordPress, PHPBB, Joomla, Drupal, Magento, MediaWiki, etc, etc.) Back when I used to do frequent freelancing for the type of client who used shared hosting, I don't think I met a single one who hosted static sites, even though for many of them static would have been more appropriate and far more secure and performant.
dspillett 11y ago
There are reasonable offerings for between 10 and 20 USD/year (from companies that are even likely to be around long enough for you to use the full year - there are cheaper still from the other sort of company) some with enough CPU+memory+disk space to be useful for more than static hosting too. Look at places like lowendtalk.com for such offers when they turn up.
GigabyteCoin 11y ago
>I've seen (can't remember where) a 3 USD/month offering. You're probably thinking of http://lowendbox.com/ http://lowendbox.com/
sofaofthedamned 11y ago
Let's Encrypt is brilliant and the web needs it but the tooling isn't quite there. For example with haproxy you need the entire chain and private key together, which I have to do manually. As the API is open it's doable - I may even do something myself. I can't wait until I have something that somebody else or I has written that, once the API is complete, you can stick in a cron job and does the concatenation and reloads haproxy/nginx/whatever. Until then the whole thing is beta. It's not even the monetary aspect - i'd happily pay for certs, but LE is so on the way to making it a devop as opposed to a finance/ops thing that it needs to be encouraged. Donation incoming...

bracewel 11y ago

Many hosting providers are choosing to integrate LE into their products directly so even if you don't get shell access you will still be able to get a cert. As far as I know both Plesk and cPanel are also working on official plugins for their software.

pfg 11y ago

That's a good point, domain registrars like GoDaddy generally don't make much on domains alone and focus on selling additional services like hosting packets (and SSL), where they probably make most of their money. However, most browser vendors are already making plans to phase out HTTP without TLS by only providing new features/APIs to HTTPS sites (and eventually by displaying http:// http:// as insecure in the UI). I think in the end this will force shared hosting providers to include domain-validated certificates (from e.g. letsencrypt) in their base packages for free. Instead, they would probably push OV and EV certs to make up for any revenue loss.

pilif 11y ago

I would imagine that shared hosting providers will just request the certificate for you in the future. Remember: This is about domain validated certs, so there's zero difference whether you request the certificate or whether your hoster does it for you.