3 ms·

Well I see people are voting me down for having the audacity to ask about compatibility with the second most popular web server in existence. Oh noes the ebil M

Well I see people are voting me down for having the audacity to ask about compatibility with the second most popular web server in existence. Oh noes the ebil Microsoftz! Seriously, though. Maybe I misunderstand. Wasn't the entire point of this project to make it as easy as possible to add and maintain a SSL cert for any website? If that's their mission statement, then they're really, really, really far away from that goal and I re-assert that they probably shouldn't be calling it "production-ready". If I'm wrong, and that's not their goal, well, fair enough. All I'm saying is I run a website based on IIS and I go to their website, there's absolutely no hint that they support Windows in any fashion whatsoever. Nor even a hint that I might be able to Google for alternative clients that do. Now I think that's a pretty damned big flaw. Maybe I'm the only one. EDIT: (As an aside, the documentation is part of the project, so if it's "not perfect yet", as you claim, that also supports that they're not ready to leave beta yet.)

pfg 11y ago
Let's Encrypt is, primarily, a CA. CAs don't "support" web servers or operating systems. They provide certificates, which are trusted by (most) clients. Traditional CAs leave the actual configuration of said certificates completely up to you. Let's Encrypt, in addition to having a protocol that's based on an IETF specification, offers a client which tries to completely automate this part, as well as renewal. Right now, this only works for apache (and, experimentally, nginx) with the official client. Note that just this alone is significantly more than what you'd get from a traditional CA. In addition to that, you also have a number of third-party clients, many of which do this for IIS as well. The stability or "feature-completeness" of the CA Let's Encrypt is completely independent from the client ecosystem. Let's Encrypt provides certificates, and those certificates work on Windows - that's pretty much it. That's why the beta label was removed.
- blakeyrat 11y ago
  I'm a consumer. I have a web server on IIS. I come to their site. How do I know this? --- The answer is: I don't. I hit the "getting started" page. I see instructions for Linux. I don't have Linux. I say "oh well," and leave. In fact that scenario is pretty much exactly what happened a few weeks ago when someone told me about let's encrypt. Which explains the post I made to this thread today.
  - pfg 11y ago
    We've already established that this is a documentation issue worth fixing, but surely you're not suggesting a lack of IIS-specific documentation on the website is reason enough to keep using the beta-label? Have you ever had the pleasure of buying a certificate from $RANDOM_CA_RESELLER? I'd have no trouble sticking an "alpha" label on the majority of those!
    - dsp1234 11y ago
      Yet, they generally have instructions on how to generate a CSR and import a certificate for IIS (along with other software). example: https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=SO6506 https://knowledge.rapidssl.com/support/ssl-certificate-suppo...
      - pfg 11y ago
        It seems you're misunderstanding what I meant with $RANDOM_CA_RESELLER. There are tons of random hosters who resell SSL certificates (sometimes as a white-label product), and many of them have terrible documentation. RapidSSL, one of the biggest CAs, is certainly not what I had in mind there. You're also missing my point that a documentation issue doesn't mean a service deserves the "beta" label.
    - deleted 11y ago
      [deleted]
  - sergiosgc 11y ago
    How do you know that certificates are OS-independent and webserver-independent? Common professional knowledge, I guess. How do you know that there are ACME clients for Windows? Irrelevant towards the beta status of the LE CA.
    - blakeyrat 11y ago
      Again: I thought the goal was to make it as easy as possible to add a SSL cert to any website. If you make the process require knowledge of acronyms like "ACME" or "LE CA", well. You've not attained that goal. You're not even close. That's the message I'm trying to get across here. If I misunderstand the goal, then by all means, correct me.

pfg 11y ago

Let's Encrypt is, primarily, a CA. CAs don't "support" web servers or operating systems. They provide certificates, which are trusted by (most) clients. Traditional CAs leave the actual configuration of said certificates completely up to you. Let's Encrypt, in addition to having a protocol that's based on an IETF specification, offers a client which tries to completely automate this part, as well as renewal. Right now, this only works for apache (and, experimentally, nginx) with the official client. Note that just this alone is significantly more than what you'd get from a traditional CA. In addition to that, you also have a number of third-party clients, many of which do this for IIS as well. The stability or "feature-completeness" of the CA Let's Encrypt is completely independent from the client ecosystem. Let's Encrypt provides certificates, and those certificates work on Windows - that's pretty much it. That's why the beta label was removed.

blakeyrat 11y ago
I'm a consumer. I have a web server on IIS. I come to their site. How do I know this? --- The answer is: I don't. I hit the "getting started" page. I see instructions for Linux. I don't have Linux. I say "oh well," and leave. In fact that scenario is pretty much exactly what happened a few weeks ago when someone told me about let's encrypt. Which explains the post I made to this thread today.
- pfg 11y ago
  We've already established that this is a documentation issue worth fixing, but surely you're not suggesting a lack of IIS-specific documentation on the website is reason enough to keep using the beta-label? Have you ever had the pleasure of buying a certificate from $RANDOM_CA_RESELLER? I'd have no trouble sticking an "alpha" label on the majority of those!
  - dsp1234 11y ago
    Yet, they generally have instructions on how to generate a CSR and import a certificate for IIS (along with other software). example: https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=SO6506 https://knowledge.rapidssl.com/support/ssl-certificate-suppo...
    - pfg 11y ago
      It seems you're misunderstanding what I meant with $RANDOM_CA_RESELLER. There are tons of random hosters who resell SSL certificates (sometimes as a white-label product), and many of them have terrible documentation. RapidSSL, one of the biggest CAs, is certainly not what I had in mind there. You're also missing my point that a documentation issue doesn't mean a service deserves the "beta" label.
  - deleted 11y ago
    [deleted]
- sergiosgc 11y ago
  How do you know that certificates are OS-independent and webserver-independent? Common professional knowledge, I guess. How do you know that there are ACME clients for Windows? Irrelevant towards the beta status of the LE CA.
  - blakeyrat 11y ago
    Again: I thought the goal was to make it as easy as possible to add a SSL cert to any website. If you make the process require knowledge of acronyms like "ACME" or "LE CA", well. You've not attained that goal. You're not even close. That's the message I'm trying to get across here. If I misunderstand the goal, then by all means, correct me.