3 ms·
You can run your own ACME provider, the code is open source. Nothing stops you from running a CA that offers 1 year certs over ACME. Or just providing one that
by tscs37 9y ago
You can run your own ACME provider, the code is open source.
Nothing stops you from running a CA that offers 1 year certs over ACME. Or just providing one that also offers 90 day certs. If people will trust that CA is another question.
The automation of LE is not the problem either. Properly automated systems would extend/renew the cert well before they are invalid, almost every LE guide I know mentions this on grounds of "what if LE is down".
The only libraries and services affected are those who do not properly code for an external service provider being temporarily offline.
The problem with OOB verification of certs is that it's slow and inefficient for almost all methods this can be done with. And it doesn't scale either.
Imagine if everyone wanted to OOB verify the Google certs on the same day.
- mort96 9y ago> Nothing stops you from running a CA that offers 1 year certs over ACME. Or just providing one that also offers 90 day certs. If people will trust that CA is another question. You know that's BS. All of your users would get certificate errors, that's what's preventing you from running your own CA.
- tscs37 9y agoRead carefully. "if people wo trust that CA is another question" Of course you won't get trusted but that's not the issue.