4 ms·

I would like to get a certificate with 3-years lifetime. I know that 90-days will limit the damage from key compromise, but I don't want to automate...

by pulse7 9y ago

blibble 9y ago
you're perfectly free to pay $10/year for a manually issued certificate from one of 50 other providers
- pulse7 9y ago
  And this is what I'm doing right now... :-)
turkishmonky 9y ago
Why not? There are even docker containers that will do everything for you, all you have to do is tag your application containers: https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa...
- chasd00 9y ago
  I use Dokku (sort of like an open source Heroku) and the LetsEncrypt plugin. I can deploy a webapp with a git push and have it run over https with no work on my part. Works great.
simias 9y ago
I was in the same boat, I didn't like having to run python on my server just to renew a SSL certificate. Still, a few months ago I decided to give it a try and I don't regret it. The certbot script is packaged in FreeBSD, it wasn't painful at all to setup and a crontask later it was over. Definitely beats the crappy free "startssl" certificates that I used previously.
- corobo 9y ago
  > startssl I must have at least 4 accounts there due to them using client certificate login. Great proof of concept why certificate based website logins never took off.
- catdog 9y ago
  There also are a lot of alternative [1] implementations which are less bloated, some are really small with only some hundred lines of code and few dependencies. [1] https://letsencrypt.org/docs/client-options/ https://letsencrypt.org/docs/client-options/
- weavie 9y ago
  acme.sh runs in pure shell, no need to install Python. It's my goto client and it just works.. everywhere. https://github.com/Neilpang/acme.sh https://github.com/Neilpang/acme.sh
  - theandrewbailey 9y ago
    Seconded. I love that it supports custom port numbers, so I can use my not privileged web server port.
  - dom0 9y ago
    acme.sh + static verification is indeed a very nice zero maintenance solution.
- icebraining 9y ago
  If you use the DNS verification, you could run the client on your local machine and then upload the cert. I started writing a small utility to do just that (and then upload the cert to CPanel using their API). It works, though I'm lazy to make it reliable enough for release.
j_s 9y ago
LetsEncrypt could easily sell extended expirations out-of-band. I see it as nearly inevitable when they need (more) money.
- pfg 9y ago
  It's unlikely. Google and Mozilla are pushing hard for short-lived certificates, and the CA/B Forum has already passed a ballot that limits certificate lifetimes to 27 months, starting with March 1, 2018. Google wants to see that brought down to 12 months and might enforce that in their own products if the CA/B Forum doesn't keep up.
  - j_s 9y ago
    Pay $10 to disable the cron job running yet another pile of 3rd-party code on a production server, even if it was (eventually) just for a year? I don't see it as a "never!". The market is probably (a) people who want to support/donate to LetsEncrypt and (b) people who are ultra-paranoid / strongly prefer less moving parts in ops. The one major downtime I'm aware of so far (a month ago) could also be a factor: Let's Encrypt is down | https://news.ycombinator.com/item?id=14374933 https://news.ycombinator.com/item?id=14374933
pixl97 9y ago
Just hope your certificate provider doesn't screw up or you may be forced to replace early. https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/eUAKwjihhBs%5B1-25%5D https://groups.google.com/a/chromium.org/forum/#!topic/blink...
breakingcups 9y ago
Why not? Automating it once will prevent you from scrambling in three years, which is exactly LetsEncrypt's point.

I would like to get a certificate with 3-years lifetime. I know that 90-days will limit the damage from key compromise, but I don't want to automate...

by pulse7 9y ago

I would like to get a certificate with 3-years lifetime. I know that 90-days will limit the damage from key compromise, but I don't want to automate...

blibble 9y ago

you're perfectly free to pay $10/year for a manually issued certificate from one of 50 other providers

pulse7 9y ago
And this is what I'm doing right now... :-)

turkishmonky 9y ago

Why not? There are even docker containers that will do everything for you, all you have to do is tag your application containers: https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa...

chasd00 9y ago
I use Dokku (sort of like an open source Heroku) and the LetsEncrypt plugin. I can deploy a webapp with a git push and have it run over https with no work on my part. Works great.

simias 9y ago

I was in the same boat, I didn't like having to run python on my server just to renew a SSL certificate. Still, a few months ago I decided to give it a try and I don't regret it. The certbot script is packaged in FreeBSD, it wasn't painful at all to setup and a crontask later it was over. Definitely beats the crappy free "startssl" certificates that I used previously.

corobo 9y ago
> startssl I must have at least 4 accounts there due to them using client certificate login. Great proof of concept why certificate based website logins never took off.
catdog 9y ago
There also are a lot of alternative [1] implementations which are less bloated, some are really small with only some hundred lines of code and few dependencies. [1] https://letsencrypt.org/docs/client-options/ https://letsencrypt.org/docs/client-options/
weavie 9y ago
acme.sh runs in pure shell, no need to install Python. It's my goto client and it just works.. everywhere. https://github.com/Neilpang/acme.sh https://github.com/Neilpang/acme.sh
- theandrewbailey 9y ago
  Seconded. I love that it supports custom port numbers, so I can use my not privileged web server port.
- dom0 9y ago
  acme.sh + static verification is indeed a very nice zero maintenance solution.
icebraining 9y ago
If you use the DNS verification, you could run the client on your local machine and then upload the cert. I started writing a small utility to do just that (and then upload the cert to CPanel using their API). It works, though I'm lazy to make it reliable enough for release.

j_s 9y ago

LetsEncrypt could easily sell extended expirations out-of-band. I see it as nearly inevitable when they need (more) money.

pfg 9y ago
It's unlikely. Google and Mozilla are pushing hard for short-lived certificates, and the CA/B Forum has already passed a ballot that limits certificate lifetimes to 27 months, starting with March 1, 2018. Google wants to see that brought down to 12 months and might enforce that in their own products if the CA/B Forum doesn't keep up.
- j_s 9y ago
  Pay $10 to disable the cron job running yet another pile of 3rd-party code on a production server, even if it was (eventually) just for a year? I don't see it as a "never!". The market is probably (a) people who want to support/donate to LetsEncrypt and (b) people who are ultra-paranoid / strongly prefer less moving parts in ops. The one major downtime I'm aware of so far (a month ago) could also be a factor: Let's Encrypt is down | https://news.ycombinator.com/item?id=14374933 https://news.ycombinator.com/item?id=14374933

pixl97 9y ago

Just hope your certificate provider doesn't screw up or you may be forced to replace early. https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/eUAKwjihhBs%5B1-25%5D https://groups.google.com/a/chromium.org/forum/#!topic/blink...

breakingcups 9y ago

Why not? Automating it once will prevent you from scrambling in three years, which is exactly LetsEncrypt's point.