3 ms·

Nice job! I found LE's client irritating to use as well. Yours sounds clean and correct. (I'm just amazed that LE decided to try modifying webserver config f

by bronson 11y ago

Nice job! I found LE's client irritating to use as well. Yours sounds clean and correct. (I'm just amazed that LE decided to try modifying webserver config files automatically. There are soooo many ways for that to fail. It's going to take an immense amount of programmer effort for very little gain.)

brazzledazzle 11y ago
It's probably motivated in no small part by helping the type of person that's currently not encrypting their application/server and should be. TLS, certificates and PKI's are something a lot of people have a hard time with. We're at a stage where people are capable of developing a web application but creating a (suitable) private key, generating a CRL and then using the resulting certificate in Apache is currently beyond their capabilities. Which is kind of cool in one sense but kind of scary in another.
- archimedespi 11y ago
  That's exactly why we designed the client that way - we wanted to make it easier for people who have no idea how to add certs to encrypt their server.
  - zaidf 11y ago
    People who have no idea how to add certs are also unlikely to know how to login to their web server using SSH or how to install a package. For people who can SSH and install packages, I think they are better served being shown how to add couple lines to make SSL work than some magic that could screw up their web server config. After all, these people chose to learn how to login to the web server instead of just managing their site from a CMS. They would probably like to learn how to configure something like SSL.
    - brazzledazzle 11y ago
      >People who have no idea how to add certs are also unlikely to know how to login to their web server using SSH or how to install a package. You'd be surprised I think. >They would probably like to learn how to configure something like SSL. I think you'd be surprised again. It's not even always about aptitude–quite often it's just laziness. The reason that many of these people aren't encrypting today is because they don't want to invest the time and effort. "My copy-pasted openssl commands didn't work? Eff this." Operations is as much a mindset as it is a skill. Some developers have it, some don't.
archimedespi 11y ago
Webserver config modification has indeed taken an immense amount of programmer effort. It's actually pretty magical when it works well, and it's suprisingly robust, but it's still filled with horrible edge cases everywhere.

by bronson 11y ago

brazzledazzle 11y ago

It's probably motivated in no small part by helping the type of person that's currently not encrypting their application/server and should be. TLS, certificates and PKI's are something a lot of people have a hard time with. We're at a stage where people are capable of developing a web application but creating a (suitable) private key, generating a CRL and then using the resulting certificate in Apache is currently beyond their capabilities. Which is kind of cool in one sense but kind of scary in another.

archimedespi 11y ago
That's exactly why we designed the client that way - we wanted to make it easier for people who have no idea how to add certs to encrypt their server.
- zaidf 11y ago
  People who have no idea how to add certs are also unlikely to know how to login to their web server using SSH or how to install a package. For people who can SSH and install packages, I think they are better served being shown how to add couple lines to make SSL work than some magic that could screw up their web server config. After all, these people chose to learn how to login to the web server instead of just managing their site from a CMS. They would probably like to learn how to configure something like SSL.
  - brazzledazzle 11y ago
    >People who have no idea how to add certs are also unlikely to know how to login to their web server using SSH or how to install a package. You'd be surprised I think. >They would probably like to learn how to configure something like SSL. I think you'd be surprised again. It's not even always about aptitude–quite often it's just laziness. The reason that many of these people aren't encrypting today is because they don't want to invest the time and effort. "My copy-pasted openssl commands didn't work? Eff this." Operations is as much a mindset as it is a skill. Some developers have it, some don't.

archimedespi 11y ago

Webserver config modification has indeed taken an immense amount of programmer effort. It's actually pretty magical when it works well, and it's suprisingly robust, but it's still filled with horrible edge cases everywhere.