4 ms·

You should definitely set up SSL/TLS for your web site. Let's Encrypt lets you easily do that.

kuschku 10y ago
Until it decides to completely fuck up your apache webserver config and you have to spend a whole day to properly configure your virtual hosts again. I’ve done it twice, never again.
- sleepychu 10y ago
  You can do it in certificate only mode. I think DNS challenge is even enabled now so you don't need to let it touch your running server at all. Of course it's a bit of admin every ~90 days but 4 times a year for free SSL isn't bad.
  - ygjb 10y ago
    Or automate it.
  - kuschku 10y ago
    DNS challenge is the worst of both: You have to manually add 60 something DNS entries, and remove them again. Just putting a public key in the DNS and being able to sign a CSR with the correspoding private key should be enough.
    - newman314 10y ago
      There are ACME clients that can automate the DNS challenge process.
      - kuschku 10y ago
        Only if your DNS system supports it, and you host it yourself. If you have DNS managed by your domain registrar, this helps you very little. So, for the average small site that’s neither made with a kit where the hoster has a one-click SSL solution, nor large enough to have their own nameservers, this is a real issue. And yet, these sites are the target demography for LE.
  - joosters 10y ago
    You're missing the point. The OP isn't claiming that Lets Encrypt is impossible to configure, so telling them that there are ways to make it work is a bit pointless. The key is that Lets Encrypt can be very difficult to configure and get things working. In a way, the numerous methods available to set up LE add to the confusion, you can search around and find lots of conflicting 'best' ways to do it.
    - sleepychu 10y ago
      Just for clarification those are two distinct issues. One: the LE client's apache magic fix up code can fail to handle fairly standard configs and mess things up. I addressed this directly, you don't need to use the apache magic configuration. Two: ACME offers numerous ways to convince it that you own a domain name. My intent was to follow this up by saying you don't even need to be running an ACME client/mess with your apache config at all by using the dns-01 challenge variant over the http-01 variant. > The key is that Lets Encrypt can be very difficult to configure and get things working. This is definitely a problem, it would be great to see a divorce between the apache config munger and the certificate fetcher. SSL available to the uninitiated is great but if they're on the command line then I'd like to believe they're capable of pointing their server at a specific location for certificates on disk.
ethbro 10y ago
Parent's in a slightly different position, but I'd expect a lot of similar things can be chalked up to the prevalence of technical consultants working for non-technical, business client management. Without authority, you can say "This is a good idea and you're taking a huge security risk without fixing it" as many times as you want and still be told "No new feature, not a development priority."

Until it decides to completely fuck up your apache webserver config and you have to spend a whole day to properly configure your virtual hosts again. I’ve done it twice, never again.

sleepychu 10y ago
You can do it in certificate only mode. I think DNS challenge is even enabled now so you don't need to let it touch your running server at all. Of course it's a bit of admin every ~90 days but 4 times a year for free SSL isn't bad.
- ygjb 10y ago
  Or automate it.
- kuschku 10y ago
  DNS challenge is the worst of both: You have to manually add 60 something DNS entries, and remove them again. Just putting a public key in the DNS and being able to sign a CSR with the correspoding private key should be enough.
  - newman314 10y ago
    There are ACME clients that can automate the DNS challenge process.
    - kuschku 10y ago
      Only if your DNS system supports it, and you host it yourself. If you have DNS managed by your domain registrar, this helps you very little. So, for the average small site that’s neither made with a kit where the hoster has a one-click SSL solution, nor large enough to have their own nameservers, this is a real issue. And yet, these sites are the target demography for LE.
- joosters 10y ago
  You're missing the point. The OP isn't claiming that Lets Encrypt is impossible to configure, so telling them that there are ways to make it work is a bit pointless. The key is that Lets Encrypt can be very difficult to configure and get things working. In a way, the numerous methods available to set up LE add to the confusion, you can search around and find lots of conflicting 'best' ways to do it.
  - sleepychu 10y ago
    Just for clarification those are two distinct issues. One: the LE client's apache magic fix up code can fail to handle fairly standard configs and mess things up. I addressed this directly, you don't need to use the apache magic configuration. Two: ACME offers numerous ways to convince it that you own a domain name. My intent was to follow this up by saying you don't even need to be running an ACME client/mess with your apache config at all by using the dns-01 challenge variant over the http-01 variant. > The key is that Lets Encrypt can be very difficult to configure and get things working. This is definitely a problem, it would be great to see a divorce between the apache config munger and the certificate fetcher. SSL available to the uninitiated is great but if they're on the command line then I'd like to believe they're capable of pointing their server at a specific location for certificates on disk.

ethbro 10y ago

Parent's in a slightly different position, but I'd expect a lot of similar things can be chalked up to the prevalence of technical consultants working for non-technical, business client management. Without authority, you can say "This is a good idea and you're taking a huge security risk without fixing it" as many times as you want and still be told "No new feature, not a development priority."