5 ms·
When I can use Let's Encrypt to get a certificate in production without running anything on my production web server, I'll consider it. Right now, StartSSL vali
by aftbit 11y ago
When I can use Let's Encrypt to get a certificate in production without running anything on my production web server, I'll consider it. Right now, StartSSL validates my domain via email and I only have to touch it once a year, not once every 3 months like Let's Encrypt.
- xxpor 11y agoCert rotation every 3 months is a feature, IMHO. It encourages you to automate everything related to rotation.
- ars 11y agoI got downmodded before for saying this, but I still feel this way: Automating this simply means that if someone hacks your machine, they also have full access to generate any certs they like. I don't consider this a positive thing. You can separate the generation onto another machine, but it's much more complicated, and the default install is not that way. I have yet to hear any useful reason to rotate the key.
- profmonocle 11y agoHasn't this always been true for domain validated certificates? If you control the domain's content, you can get a cert. I don't see how LE makes that any worse.
- thesimon 11y ago>Automating this simply means that if someone hacks your machine, they also have full access to generate any certs they like. Well, they can generate certs for your domain. But what exactly is the big difference between generating a new certificate for your domain and having your private key. I fail to see why it would be a huge risk, they can access all your users data in any case. >I have yet to hear any useful reason to rotate the key. http://security.stackexchange.com/questions/85963/what-is-the-purpose-of-frequently-rotating-tls-certificates-without-changing-und http://security.stackexchange.com/questions/85963/what-is-th... Basically limiting damage in case of a compromise.
- Laforet 11y agoA short validity period also helps to keep the size of revocation lists manageable as they expire sooner.
- imaginenore 11y agoIf they hack your machine, they can generate new certificates whether you have LetsEncrypt installed or not. They can just install it.
- rakoo 11y agoIt's like not-perfect-but-still-good forward secrecy: Your old certificate may be leaked or decrypted, but it will only endanger past communications; the communications after this one will still be secure. Another side-effect is that you don't need to manage revocation stuff as diligently, because certificates automatically expire shortly. The window during which a certificate is valid is extremely short and recent, which means there is less chance that a problem happens. when that probability increases (as a result of being older), certificates become automatically invalid.
- marcosdumay 11y agoWell, they can generate new certificates for as long as they have access to your machine. Take that access away, and they can't generate certificates anymore. All in, the Lets Encrypt way brings you more security. Since the certificate validity is shorter, even generating an extra certificate will give the attacker a smaller average time with a valid cert than stealing your StartSSL cert.
- imron 11y agoI just set up Let's Encrypt on a number of my sites. I'll take an automated process I run via cronjob and that requires no manual intervention, over a process that requires I touch it once a year. The decision (to me) is a no-brainer.
- imperalix 11y agoI use Let's Encrypt DNS validation. This does not require you to run anything on your server. You just need to have a way to distribute cert to your servers.
- sandGorgon 11y agocan you explain this ? I'm trying to bake letsencrypt certificates in my docker images and I am trying to figure out a way around the race condition (nginx needs a certificate to run <-> certificate needs nginx to run).
- kccqzy 11y agoYou can obtain a certificate by running let's encrypt's docker image, which seems to contain a python web server just to do the validation.
- sandGorgon 11y agocannot run a docker inside a docker. the problem is not running a webserver, the problem is the race condition which needs to be solved when docker starts up.
- imron 11y agoHow about storing the letsencrypt certificates in a data-container/locally on the host and mapping those files to the nginx container when you start it? For the very first time, you can use let's encrypt's manual verification process, but then have the let's encrypt client set up to renew certs automatically (possibly even from a separate container) using same data file mappings.
- sandGorgon 11y agowhich is why im preferring to spend 10$ on a certificate instead (or rather 85$ for a wildcard).
- vacri 11y ago
- veeti 11y agoI'm afraid you'll have to go through renewal every 3 months, but I'll still make a shameless plug of my client [1]. It uses DNS validation exclusively so you can generate certificates wherever you want. In addition, domain authorizations last for 10 months, so you don't have to go through the DNS verification each time: just renewing is sufficient. Run the issue command, drop new certs into configuration management, done. Couple minutes tops. Just set your calendar! [1] https://github.com/veeti/manuale https://github.com/veeti/manuale
- arantius 11y agoThanks! A hands-off (on?) manual client is what I always wanted. I've just finally used Let's Encrypt for the first time, with manuale.