4 ms·
I am kind of thankful for this. It gave us immediate time budget to switch our certificate process over to Letsencrypt. I'm also glad it does not affect existi
by jo909 10y ago
I am kind of thankful for this. It gave us immediate time budget to switch our certificate process over to Letsencrypt.
I'm also glad it does not affect existing certs, since we need some weeks to ramp up the LE certs because of the 20 new certs per week limit (we can continue to only bundle subdomains per cert that are actually used on the same host/loadbalancer).
- emilburzo 10y agoDo you have multiple hosts serving the same domain by any chance? I'm wondering if there's been any progress in finding an easy solution for this use-case.
- pilif 10y agoMany if not all of the acme clients out there store the key and certificate as a file. Just copy that to the various machines terminating the SSL connection. In our case, there's a script on the frontend machine running HAProxy that's fetching the certificates and putting them on a shared file system so the backup machine also has access to them. The traffic between frontend host and application servers is unencrypted in our case as it's all one rack under our control. If it wasn't, we'd be using a self-signed certificate for that connection.