4 ms·

Their own "getting started" page mentions nothing about Windows/IIS. Maybe you're right, but how would a potential user know it?

pfg 11y ago
Sure, the documentation isn't perfect yet. The client is being split from the CA in the near-future (as well as renamed), so this aspect of the documentation will need to be reworked anyway. That being said, I sincerely hope that anyone responsible for TLS deployment knows how to use a search engine and enter "letsencrypt windows".
- blakeyrat 11y ago
  Well I see people are voting me down for having the audacity to ask about compatibility with the second most popular web server in existence. Oh noes the ebil Microsoftz! Seriously, though. Maybe I misunderstand. Wasn't the entire point of this project to make it as easy as possible to add and maintain a SSL cert for any website? If that's their mission statement, then they're really, really, really far away from that goal and I re-assert that they probably shouldn't be calling it "production-ready". If I'm wrong, and that's not their goal, well, fair enough. All I'm saying is I run a website based on IIS and I go to their website, there's absolutely no hint that they support Windows in any fashion whatsoever. Nor even a hint that I might be able to Google for alternative clients that do. Now I think that's a pretty damned big flaw. Maybe I'm the only one. EDIT: (As an aside, the documentation is part of the project, so if it's "not perfect yet", as you claim, that also supports that they're not ready to leave beta yet.)
  - pfg 11y ago
    Let's Encrypt is, primarily, a CA. CAs don't "support" web servers or operating systems. They provide certificates, which are trusted by (most) clients. Traditional CAs leave the actual configuration of said certificates completely up to you. Let's Encrypt, in addition to having a protocol that's based on an IETF specification, offers a client which tries to completely automate this part, as well as renewal. Right now, this only works for apache (and, experimentally, nginx) with the official client. Note that just this alone is significantly more than what you'd get from a traditional CA. In addition to that, you also have a number of third-party clients, many of which do this for IIS as well. The stability or "feature-completeness" of the CA Let's Encrypt is completely independent from the client ecosystem. Let's Encrypt provides certificates, and those certificates work on Windows - that's pretty much it. That's why the beta label was removed.
    - blakeyrat 11y ago
      I'm a consumer. I have a web server on IIS. I come to their site. How do I know this? --- The answer is: I don't. I hit the "getting started" page. I see instructions for Linux. I don't have Linux. I say "oh well," and leave. In fact that scenario is pretty much exactly what happened a few weeks ago when someone told me about let's encrypt. Which explains the post I made to this thread today.
      - pfg 11y ago
        We've already established that this is a documentation issue worth fixing, but surely you're not suggesting a lack of IIS-specific documentation on the website is reason enough to keep using the beta-label? Have you ever had the pleasure of buying a certificate from $RANDOM_CA_RESELLER? I'd have no trouble sticking an "alpha" label on the majority of those!
        dsp1234 11y ago
        Yet, they generally have instructions on how to generate a CSR and import a certificate for IIS (along with other software). example: https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=SO6506 https://knowledge.rapidssl.com/support/ssl-certificate-suppo...
        pfg 11y ago
        It seems you're misunderstanding what I meant with $RANDOM_CA_RESELLER. There are tons of random hosters who resell SSL certificates (sometimes as a white-label product), and many of them have terrible documentation. RapidSSL, one of the biggest CAs, is certainly not what I had in mind there. You're also missing my point that a documentation issue doesn't mean a service deserves the "beta" label.
        deleted 11y ago
        [deleted]
      - sergiosgc 11y ago

pfg 11y ago

Sure, the documentation isn't perfect yet. The client is being split from the CA in the near-future (as well as renamed), so this aspect of the documentation will need to be reworked anyway. That being said, I sincerely hope that anyone responsible for TLS deployment knows how to use a search engine and enter "letsencrypt windows".

blakeyrat 11y ago
Well I see people are voting me down for having the audacity to ask about compatibility with the second most popular web server in existence. Oh noes the ebil Microsoftz! Seriously, though. Maybe I misunderstand. Wasn't the entire point of this project to make it as easy as possible to add and maintain a SSL cert for any website? If that's their mission statement, then they're really, really, really far away from that goal and I re-assert that they probably shouldn't be calling it "production-ready". If I'm wrong, and that's not their goal, well, fair enough. All I'm saying is I run a website based on IIS and I go to their website, there's absolutely no hint that they support Windows in any fashion whatsoever. Nor even a hint that I might be able to Google for alternative clients that do. Now I think that's a pretty damned big flaw. Maybe I'm the only one. EDIT: (As an aside, the documentation is part of the project, so if it's "not perfect yet", as you claim, that also supports that they're not ready to leave beta yet.)
- pfg 11y ago
  Let's Encrypt is, primarily, a CA. CAs don't "support" web servers or operating systems. They provide certificates, which are trusted by (most) clients. Traditional CAs leave the actual configuration of said certificates completely up to you. Let's Encrypt, in addition to having a protocol that's based on an IETF specification, offers a client which tries to completely automate this part, as well as renewal. Right now, this only works for apache (and, experimentally, nginx) with the official client. Note that just this alone is significantly more than what you'd get from a traditional CA. In addition to that, you also have a number of third-party clients, many of which do this for IIS as well. The stability or "feature-completeness" of the CA Let's Encrypt is completely independent from the client ecosystem. Let's Encrypt provides certificates, and those certificates work on Windows - that's pretty much it. That's why the beta label was removed.
  - blakeyrat 11y ago
    I'm a consumer. I have a web server on IIS. I come to their site. How do I know this? --- The answer is: I don't. I hit the "getting started" page. I see instructions for Linux. I don't have Linux. I say "oh well," and leave. In fact that scenario is pretty much exactly what happened a few weeks ago when someone told me about let's encrypt. Which explains the post I made to this thread today.
    - pfg 11y ago
      We've already established that this is a documentation issue worth fixing, but surely you're not suggesting a lack of IIS-specific documentation on the website is reason enough to keep using the beta-label? Have you ever had the pleasure of buying a certificate from $RANDOM_CA_RESELLER? I'd have no trouble sticking an "alpha" label on the majority of those!
      - dsp1234 11y ago
        Yet, they generally have instructions on how to generate a CSR and import a certificate for IIS (along with other software). example: https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=SO6506 https://knowledge.rapidssl.com/support/ssl-certificate-suppo...
        pfg 11y ago
        It seems you're misunderstanding what I meant with $RANDOM_CA_RESELLER. There are tons of random hosters who resell SSL certificates (sometimes as a white-label product), and many of them have terrible documentation. RapidSSL, one of the biggest CAs, is certainly not what I had in mind there. You're also missing my point that a documentation issue doesn't mean a service deserves the "beta" label.
      - deleted 11y ago
        [deleted]
    - sergiosgc 11y ago