6 ms·

I wish they would make Microsoft IIS a first class citizens. If they are true to their mission they should set any political reasons aside, and provide official

I wish they would make Microsoft IIS a first class citizens. If they are true to their mission they should set any political reasons aside, and provide official support for all platforms. AFAIK there are no technical reasons that prevents them to implement support for IIS and Azure Web Sites. There are a number of user created solution for both, that works well, but i would feel more comfortable with using that in production with official vendor support. So either Microsoft should fund this or lets encrypt should and i wonder why none of them has.

toomuchtodo 9y ago
Have you tried asking Microsoft for Azure support of it? Devil’s advocate: AWS rolled their own CA and cert management system.
- ToFab123 9y ago
  It requires an Enterprise Support Agreement to ask that kind of questions to the IIS / Azure Web App product team and I do not have that. It super simple to buy and add a paid SSL certificate to your Azure Web Site, but a paid solutions is not the topic of this thread.
  - SwellJoe 9y ago
    "It requires an Enterprise Support Agreement to ask that kind of questions to the IIS / Azure Web App product team and I do not have that." Sounds like you're running the wrong web server for your needs, then. Every OSS web server has several methods for getting LE certificates implemented mostly by volunteers (my company implemented it in Virtualmin, both the OSS projects and commercial products, within a couple days of it being available, maybe even during the beta I don't recall exactly, and we're just a couple of developers), and you don't have to have an enterprise contract to make suggestions.
  - kalleboo 9y ago
    > but a paid solutions is not the topic of this thread. AWS has their own CA that issues free SSL certs for their customers for use with stuff like CloudFront, I don't see any reason Microsoft couldn't do the same if they're not willing to play nice with Let's Encrypt.
    - ToFab123 9y ago
      ohh I wasn't aware of the AWS had a free SSL cert solution. I don't see any reason as well why Microsoft doesn't provide a similar service for their customer.
      - kalleboo 9y ago
        Yeah it's pretty handy. It also does a lot of the auto-renewal stuff that certbot does for you if you're using Lets Encrypt. More info here https://aws.amazon.com/certificate-manager/?nc1=h_ls https://aws.amazon.com/certificate-manager/?nc1=h_ls
partiallypro 9y ago
I'm hoping Microsoft releases a tool/blade for managing certs in general, even with a marketplace with auto-renewals, etc. The third party extension for Azure web apps for Let's Encrypt isn't bad it's just a pain to set up the first go round. https://www.siteextensions.net/packages/letsencrypt/ https://www.siteextensions.net/packages/letsencrypt/
jaas 9y ago
Let's Encrypt doesn't directly produce any client software. ACME clients are built by our community and the community builds what they feel like building. If something hasn't been done yet, or isn't where you want it to be, that reflects community priorities, not our politics. We'd love to work more closely with Microsoft. We've been talking with Microsoft and various Microsoft community members about building great support for IIS since before Let's Encrypt launched.
- ToFab123 9y ago
  Thank you for clearing that up and my apologies for implying political motivation on your side!
lwhalen 9y ago
Not trying to start a Slashdot-class flame war or anything, but why are you on a platform that is so... belligerent to being on a network? Microsoft has been dead to me in the datacenter for at least ten years, for reasons far beyond the peanut-gallery "hur hur M$ $ucks!" There's oodles of options, many of which are far simpler to manage than a Microsoft stack, with commercial support available. I'm genuinely curious, what's keeping you there?
- flomo 9y ago
  Because I downvoted you, I'll say that critiques like this are totally ineffective without examples. I haven't worked with Windows/IIS in like ten years, but I recall they had APIs for certificate management and http, system scripting languages (including javascript), scheduling tools and so on. Not sure what else you would want or need. If you have a substantial argument, it would be interesting to hear it. (And I'll say I'm only posting this because I've had some not-good experiences with certbot. It is essentially a big foreign environment nailed onto your host and another 'thing' to tend to. Or perhaps you would describe it as Ubuntu Linux being "network belligerent.")
  - lwhalen 9y ago
    I greatly appreciate the comment giving further context to your downvote. That is all too rare around here! Big criticisms I have around the recent Microsoft server offerings: - Opaque and uncommon/needlessly-unfamiliar command-line management toolkit (seriously, what is so difficult about 'output text, receive text as input' in 2017?) - I cannot, yet, fully manage a Microsoft host from the CLI. What I consider to be 'fully managed' revolves around: installing software, updating software, adding/removing/'managing' users, setting up basic server-like features such as simple firewall rules, viewing common log-files ('user X logged in', 'software Y tried to execute Z task, the result was A'), starting/stopping/troubleshooting daemons, etc - Pick a major config-management system (my direct experience is with Puppet/Chef/Ansible/Salt). Configuring them to play nice with Windows-anything is an order of magnitude more difficult than even the most baroque *nix-like operating system. - Licensing. Srsly, charging for the operating system, THEN the web server, AND the 'remote desktop server', PLUS the mail server... is downright punitive. Microsoft does exactly none of these 'well', but they still think they should be able to charge money for it. Their customers, in my opinion, must be masochists. Lest I be accused of being completely unfamiliar/anti-Microsoft, here's a couple of things I feel they do quite well: - remote/centralized user management (seriously, Active Directory's extensions and integration of LDAP/Kerberos are quite impressive). Pity it's not even remotely open-sourced, as such any modifications (hesitant to use the word 'improvements') are effectively prohibitively difficult to bring forward unless you're a Microsoft employee, directly assigned to the Active Directory group, in good standing with your direct manager and his manager's manager. - AAA (authentication/authorization/accounting) - given their AD prowess above, they'd have to be a special kind of stupid to foul this one up. To their credit, it is amazingly easy to assign RBAC to a group of users and apply it site/directory/'forest'-wide, then go back and bean-count exactly which users did what and when, if needed. For a lot of environments, this is a huge plus. Still, for the vast majority of 'webby' environments, in my professional opinion, Microsoft hasn't been able to hack it for at least a decade now. The market has moved on to more powerful, less costly, more manageable/scaleable platforms. If you're running an application, or even serving basic web content, on a Windows-anything, you're needlessly wasting your business time/money/agony if you choose to implement it on a Microsoft stack.
askvictor 9y ago
I've used https://github.com/Lone-Coder/letsencrypt-win-simple https://github.com/Lone-Coder/letsencrypt-win-simple to good effect; it's under active development, and has Azure DNS support. Doesn't help with Azure-hosted sites as such, but works great with IIS.
xenophonf 9y ago
You want ACMESharp: https://pkisharp.github.io/ACMESharp-docs/ https://pkisharp.github.io/ACMESharp-docs/

toomuchtodo 9y ago

Have you tried asking Microsoft for Azure support of it? Devil’s advocate: AWS rolled their own CA and cert management system.

ToFab123 9y ago
It requires an Enterprise Support Agreement to ask that kind of questions to the IIS / Azure Web App product team and I do not have that. It super simple to buy and add a paid SSL certificate to your Azure Web Site, but a paid solutions is not the topic of this thread.
- SwellJoe 9y ago
  "It requires an Enterprise Support Agreement to ask that kind of questions to the IIS / Azure Web App product team and I do not have that." Sounds like you're running the wrong web server for your needs, then. Every OSS web server has several methods for getting LE certificates implemented mostly by volunteers (my company implemented it in Virtualmin, both the OSS projects and commercial products, within a couple days of it being available, maybe even during the beta I don't recall exactly, and we're just a couple of developers), and you don't have to have an enterprise contract to make suggestions.
- kalleboo 9y ago
  > but a paid solutions is not the topic of this thread. AWS has their own CA that issues free SSL certs for their customers for use with stuff like CloudFront, I don't see any reason Microsoft couldn't do the same if they're not willing to play nice with Let's Encrypt.
  - ToFab123 9y ago
    ohh I wasn't aware of the AWS had a free SSL cert solution. I don't see any reason as well why Microsoft doesn't provide a similar service for their customer.
    - kalleboo 9y ago
      Yeah it's pretty handy. It also does a lot of the auto-renewal stuff that certbot does for you if you're using Lets Encrypt. More info here https://aws.amazon.com/certificate-manager/?nc1=h_ls https://aws.amazon.com/certificate-manager/?nc1=h_ls

partiallypro 9y ago

I'm hoping Microsoft releases a tool/blade for managing certs in general, even with a marketplace with auto-renewals, etc. The third party extension for Azure web apps for Let's Encrypt isn't bad it's just a pain to set up the first go round. https://www.siteextensions.net/packages/letsencrypt/ https://www.siteextensions.net/packages/letsencrypt/

jaas 9y ago

Let's Encrypt doesn't directly produce any client software. ACME clients are built by our community and the community builds what they feel like building. If something hasn't been done yet, or isn't where you want it to be, that reflects community priorities, not our politics. We'd love to work more closely with Microsoft. We've been talking with Microsoft and various Microsoft community members about building great support for IIS since before Let's Encrypt launched.

ToFab123 9y ago
Thank you for clearing that up and my apologies for implying political motivation on your side!

lwhalen 9y ago

Not trying to start a Slashdot-class flame war or anything, but why are you on a platform that is so... belligerent to being on a network? Microsoft has been dead to me in the datacenter for at least ten years, for reasons far beyond the peanut-gallery "hur hur M$ $ucks!" There's oodles of options, many of which are far simpler to manage than a Microsoft stack, with commercial support available. I'm genuinely curious, what's keeping you there?

flomo 9y ago
Because I downvoted you, I'll say that critiques like this are totally ineffective without examples. I haven't worked with Windows/IIS in like ten years, but I recall they had APIs for certificate management and http, system scripting languages (including javascript), scheduling tools and so on. Not sure what else you would want or need. If you have a substantial argument, it would be interesting to hear it. (And I'll say I'm only posting this because I've had some not-good experiences with certbot. It is essentially a big foreign environment nailed onto your host and another 'thing' to tend to. Or perhaps you would describe it as Ubuntu Linux being "network belligerent.")
- lwhalen 9y ago
  I greatly appreciate the comment giving further context to your downvote. That is all too rare around here! Big criticisms I have around the recent Microsoft server offerings: - Opaque and uncommon/needlessly-unfamiliar command-line management toolkit (seriously, what is so difficult about 'output text, receive text as input' in 2017?) - I cannot, yet, fully manage a Microsoft host from the CLI. What I consider to be 'fully managed' revolves around: installing software, updating software, adding/removing/'managing' users, setting up basic server-like features such as simple firewall rules, viewing common log-files ('user X logged in', 'software Y tried to execute Z task, the result was A'), starting/stopping/troubleshooting daemons, etc - Pick a major config-management system (my direct experience is with Puppet/Chef/Ansible/Salt). Configuring them to play nice with Windows-anything is an order of magnitude more difficult than even the most baroque *nix-like operating system. - Licensing. Srsly, charging for the operating system, THEN the web server, AND the 'remote desktop server', PLUS the mail server... is downright punitive. Microsoft does exactly none of these 'well', but they still think they should be able to charge money for it. Their customers, in my opinion, must be masochists. Lest I be accused of being completely unfamiliar/anti-Microsoft, here's a couple of things I feel they do quite well: - remote/centralized user management (seriously, Active Directory's extensions and integration of LDAP/Kerberos are quite impressive). Pity it's not even remotely open-sourced, as such any modifications (hesitant to use the word 'improvements') are effectively prohibitively difficult to bring forward unless you're a Microsoft employee, directly assigned to the Active Directory group, in good standing with your direct manager and his manager's manager. - AAA (authentication/authorization/accounting) - given their AD prowess above, they'd have to be a special kind of stupid to foul this one up. To their credit, it is amazingly easy to assign RBAC to a group of users and apply it site/directory/'forest'-wide, then go back and bean-count exactly which users did what and when, if needed. For a lot of environments, this is a huge plus. Still, for the vast majority of 'webby' environments, in my professional opinion, Microsoft hasn't been able to hack it for at least a decade now. The market has moved on to more powerful, less costly, more manageable/scaleable platforms. If you're running an application, or even serving basic web content, on a Windows-anything, you're needlessly wasting your business time/money/agony if you choose to implement it on a Microsoft stack.

askvictor 9y ago

I've used https://github.com/Lone-Coder/letsencrypt-win-simple https://github.com/Lone-Coder/letsencrypt-win-simple to good effect; it's under active development, and has Azure DNS support. Doesn't help with Azure-hosted sites as such, but works great with IIS.

xenophonf 9y ago

You want ACMESharp: https://pkisharp.github.io/ACMESharp-docs/ https://pkisharp.github.io/ACMESharp-docs/