2 ms·
> What reason for existence will they have then? EV certs? I doubt that corporate users will move in any significant numbers to LE, even for basic DV certs. T
by dingaling 11y ago
> What reason for existence will they have then? EV certs?
I doubt that corporate users will move in any significant numbers to LE, even for basic DV certs.
Two reasons:
1. The certificate renewal process appears to be incompatible with most corporate change-control processes I've encountered: nothing may change on a production server unless an admin is given authorisation to change it. A cron job that could take all customer-facing services offline is just crazy[0].
2. When something goes wrong with a cert issuance or renewal, corporate users ( want | need ) to be able to call a human to have them fix it, regardless of cost. And even that cost is insignificant in context to revenue.
I'm sure LE will be popular with bloggers and hobby users. Beyond that?
[0] yes, the admins could run the LE client manually in non-prod and move the certs over to production. But that's no easier than current cert renewals, and would have to occur every 60-90 days.
- toomuchtodo 11y agoSomeone who is responsible for a site's uptime is going to be more conservative about changes being made, most definitely. As a sysadmin, I don't think Let's Encrypt's 90 day expiration period is too onerous, but if I can sidestep that aggressive expiration period with a $300-600 wildcard cert that expires yearly from a traditional CA, that's the route I'm going to go (when my fully loaded costs to my employer are on the low end of that cost per hour). Disclaimer: I'm a big proponent of Let's Encrypt, and tweeted at Jeff Barr @ AWS asking if they could integrate its lifecycle into AWS' IAM SSL ecosystem.
- userbinator 11y agoI think servers are patched a bit more often than 90 days now, so the expiration period is not that short.
- toomuchtodo 11y agoPatching servers and cycling SSL certificates are apples and oranges. Depending on the size of the org, you may have several divisions that need to have new key/certs distributed to them, and their environments updated through change requests processes. Not everyone are teams of 5-20 on EC2 or DigitalOcean.