3 ms·

This new name and website are a big improvement to the branding of the client, and make it clear that this client is not a requirement for getting a certificate

This new name and website are a big improvement to the branding of the client, and make it clear that this client is not a requirement for getting a certificate from Let's Encrypt. It was very difficult to explain to people learning about it that there is a difference between: 1. Let's Encrypt, the certificate authority 2. ACME, the protocol for users to interact with Let's Encrypt 3. Boulder, an implementation of an ACME server in Go that Let's Encrypt uses 4. Certbot (formerly the Let's Encrypt client), a command line client and ACME library for Python, originally developed by the Let's Encrypt team Any CA can use ACME to offer automated certificate issuance to their users. Anyone can implement an ACME server or client in any language. There is no "official" client or server necessary. It's also important that Certbot was rebranded to distance it from Let's Encrypt because, personally, I think the project is doomed to fail. It tries to handle both certificate issuance and configuration of software using certificates. It attempts to abstract the process for someone who barely understands what certificates/SSL/TLS are (if at all), but requires so much detail from them in order to configure and run the client that they might well have just learned how it worked in the first place. In other words, Certbot's use case targets laymen, but requires non-layman understanding to use. It doesn't help that their documentation is very badly organized and confusing, often mixing content for the CLI and the Python Library, which have different audiences: end users and developers building an automated tool in Python. Meanwhile, intermediate and advanced developers and system administrators who understand the concepts are much better served by a different client that simply takes care of certificate issuance without trying to automatically manage the software they will be using the certificate with. There are many, but so far I've been happy with Lego (https://github.com/xenolf/lego https://github.com/xenolf/lego).

pde3 10y ago
I think your criticisms were pretty fair of the earliest releases of the Let's Encrypt client, but they seem to be less accurate now. We see the client (aka Certbot) being used successfully by many hundreds of thousands of site operators. In terms of full automation, the Apache plugin has gone from "experimental" to "works for most people automatically". We'll be working on delivering similar features for Nginx next. But if lego works for you; that's great!
- niij 10y ago
  Does Certbot have the ability to only output the signed certs to a specified directory and nothing more?
  - pde3 10y ago
    At the moment you can get that behaviour with "certonly --csr". You'll need to make a CSR file yourself. It'll drop your cert and chain files in the current directory. You'll still have an account key and some other ACME protocol housekeeping state in /etc/letsencrypt. https://github.com/certbot/certbot/issues/2373 https://github.com/certbot/certbot/issues/2373 will track implementation a nicer version of that functionality; it'll probably be --no-lineages (lineages are Certbot's notion of a succession of renewed or updated certificates that replace each other; they live in /etc/letsencrypt/live, though you can put them somewhere else with the --config-dir option)
vtlynch 10y ago
The large majority of sites using Let's Encrypt certificates are first-time users of SSL. So far they are succeeding with that demographic and one of their key goals was to spread SSL to previously unencrypted sites.

pde3 10y ago

I think your criticisms were pretty fair of the earliest releases of the Let's Encrypt client, but they seem to be less accurate now. We see the client (aka Certbot) being used successfully by many hundreds of thousands of site operators. In terms of full automation, the Apache plugin has gone from "experimental" to "works for most people automatically". We'll be working on delivering similar features for Nginx next. But if lego works for you; that's great!

niij 10y ago
Does Certbot have the ability to only output the signed certs to a specified directory and nothing more?
- pde3 10y ago
  At the moment you can get that behaviour with "certonly --csr". You'll need to make a CSR file yourself. It'll drop your cert and chain files in the current directory. You'll still have an account key and some other ACME protocol housekeeping state in /etc/letsencrypt. https://github.com/certbot/certbot/issues/2373 https://github.com/certbot/certbot/issues/2373 will track implementation a nicer version of that functionality; it'll probably be --no-lineages (lineages are Certbot's notion of a succession of renewed or updated certificates that replace each other; they live in /etc/letsencrypt/live, though you can put them somewhere else with the --config-dir option)

vtlynch 10y ago

The large majority of sites using Let's Encrypt certificates are first-time users of SSL. So far they are succeeding with that demographic and one of their key goals was to spread SSL to previously unencrypted sites.