7 ms·

Honestly I've been holding back on going with lets encrypt at my 9-5, partly because certificates through namecheap/comodo are only $9.95 per year. I'm surprise

Honestly I've been holding back on going with lets encrypt at my 9-5, partly because certificates through namecheap/comodo are only $9.95 per year. I'm surprised by how much market share it has already, time to jump on board. I imagine paid for certificates will be dead in a few years.

blibble 9y ago
I was surprised how easy it was to setup, and the huge advantage is that you never have to worry about renewals and the various problems associated with forgetting to renew ever again
gregmac 9y ago
I recently have been working on moving a chunk of our infrastructure to a fully automated deployment. It consists of several micro services on various subdomains within 3 top level domains. For the dev and staging environments, I used a sub-domain prefix: app1.staging.example.com, downloads.staging.examplecdn.com, etc. There's a script that looks through the deployed systems in it's environment and configures the proxy server appropriately -- including running certbot if needed to get certificates. I used let's encrypt initially so we could actually test real SSL without the hassle of new certificates, especially when we wanted to deploy a new environment. It worked so well we just left it in when we deployed to production. The cost of certificates is nothing compared to the effort to get someone to put it on the company card, renew it (and answer questions about what it is a year from now, yes we still need it), manage the private key, etc. Let's Encrypt is better in every way.
- joering2 9y ago
  Lets Encrypt provides wonderful services, but don't forget in business when something is free, it might end up costing you money. Not only these certs are for 3 months, but what if their renewal services have hiccups. Not wishing them anything bad, but I can imagine that for whatever reason (including root cert being invoked if they happen to encrypt sites that normally wouldn't do like c.p.) I imagine that 35% of net rushing to a local cert provider to get a paid solution or face no traffic to their site at all. Besides, the times of Thawte's 1999 when single cert was $150 are long gone; you can get a decent Comodo for $4.99 per year these days.
  - cm2187 9y ago
    Wildcard certs are still expensive. And convenience of an automated process plays a big role. CA have been asleep at the wheel, not improving their products and offering a convenient way to manage the renewal.
    - gregmac 9y ago
      Totally agree. If CAs were smart they'd be implementing the ACME protocol, and attaching it to their (paid) backend systems. There's value to be added like longer expiry times and long-term assurances, a centralized management portal, wildcard and EV certificates, and higher (or no) re-issue limits that would go a long way to getting businesses using it.
    - joering2 9y ago
      Define expensive? https://www.cheapsslshop.com/ https://www.cheapsslshop.com/ sells wildcards for $56 with easily to find discount code CMDWCXM25. If you need wildcard most likely your have some sort of production platform and probably make some profits, at least $5 a month for a cert. Full disclaimer: have nothing to do with cheapsslshop but been their happy client for few years now.
  - vertex-four 9y ago
    Due to the lack of automated renewal procedures, I've seen many more small websites die for a day or so once a year with "traditional" certificates (when people forget to manually renew) than those with certificates maintained via letsencrypt. The actual solution to this should be for any of those providers to provide the ACME certificate management protocol, and then if letsencrypt fails, I can point certbot at it.
    - wastedhours 9y ago
      I was always on that end - in a distant-ago job I'd somehow fallen into a position of looking after a server box for our subdomain that was under someone's desk. Every year I'd preempt it and email our procurement and IT teams asking for a renewal months in advance (knowing the red tape means I'd get it JIT). And, every year it wouldn't be renewed or bought until the day after expiry when I had enough complaints from people to light a fire under someone's arse. The whole cert-package back and forth was a nightmare, am glad LE exists with auto renewals (or even manually pushing a renewal with one line is easier than the old).
medmunds 9y ago
I’d been in the exact same not-worth-the-hassle-to-change-for-only-$9.95 mindset on one of my side projects. That is, until last year when Comodo engaged in some really shady behavior directed at Let’s Encrypt [1]. At that point, decided there was no way I was going to keep rewarding Comodo with my business — not even a measly ten bucks’ worth. And now I couldn’t be happier I switched to Let’s Encrypt. Automatic renewals mean no more working through the partially-manual, email-based process we had to use with Comodo. And free+automated means I don’t think twice about using https on every new subdomain. Really, I don’t think at all about https anymore; it just works. [1]: https://news.ycombinator.com/item?id=11964583 https://news.ycombinator.com/item?id=11964583

blibble 9y ago

I was surprised how easy it was to setup, and the huge advantage is that you never have to worry about renewals and the various problems associated with forgetting to renew ever again

gregmac 9y ago

I recently have been working on moving a chunk of our infrastructure to a fully automated deployment. It consists of several micro services on various subdomains within 3 top level domains. For the dev and staging environments, I used a sub-domain prefix: app1.staging.example.com, downloads.staging.examplecdn.com, etc. There's a script that looks through the deployed systems in it's environment and configures the proxy server appropriately -- including running certbot if needed to get certificates. I used let's encrypt initially so we could actually test real SSL without the hassle of new certificates, especially when we wanted to deploy a new environment. It worked so well we just left it in when we deployed to production. The cost of certificates is nothing compared to the effort to get someone to put it on the company card, renew it (and answer questions about what it is a year from now, yes we still need it), manage the private key, etc. Let's Encrypt is better in every way.

joering2 9y ago
Lets Encrypt provides wonderful services, but don't forget in business when something is free, it might end up costing you money. Not only these certs are for 3 months, but what if their renewal services have hiccups. Not wishing them anything bad, but I can imagine that for whatever reason (including root cert being invoked if they happen to encrypt sites that normally wouldn't do like c.p.) I imagine that 35% of net rushing to a local cert provider to get a paid solution or face no traffic to their site at all. Besides, the times of Thawte's 1999 when single cert was $150 are long gone; you can get a decent Comodo for $4.99 per year these days.
- cm2187 9y ago
  Wildcard certs are still expensive. And convenience of an automated process plays a big role. CA have been asleep at the wheel, not improving their products and offering a convenient way to manage the renewal.
  - gregmac 9y ago
    Totally agree. If CAs were smart they'd be implementing the ACME protocol, and attaching it to their (paid) backend systems. There's value to be added like longer expiry times and long-term assurances, a centralized management portal, wildcard and EV certificates, and higher (or no) re-issue limits that would go a long way to getting businesses using it.
  - joering2 9y ago
    Define expensive? https://www.cheapsslshop.com/ https://www.cheapsslshop.com/ sells wildcards for $56 with easily to find discount code CMDWCXM25. If you need wildcard most likely your have some sort of production platform and probably make some profits, at least $5 a month for a cert. Full disclaimer: have nothing to do with cheapsslshop but been their happy client for few years now.
- vertex-four 9y ago
  Due to the lack of automated renewal procedures, I've seen many more small websites die for a day or so once a year with "traditional" certificates (when people forget to manually renew) than those with certificates maintained via letsencrypt. The actual solution to this should be for any of those providers to provide the ACME certificate management protocol, and then if letsencrypt fails, I can point certbot at it.
  - wastedhours 9y ago
    I was always on that end - in a distant-ago job I'd somehow fallen into a position of looking after a server box for our subdomain that was under someone's desk. Every year I'd preempt it and email our procurement and IT teams asking for a renewal months in advance (knowing the red tape means I'd get it JIT). And, every year it wouldn't be renewed or bought until the day after expiry when I had enough complaints from people to light a fire under someone's arse. The whole cert-package back and forth was a nightmare, am glad LE exists with auto renewals (or even manually pushing a renewal with one line is easier than the old).

medmunds 9y ago

I’d been in the exact same not-worth-the-hassle-to-change-for-only-$9.95 mindset on one of my side projects. That is, until last year when Comodo engaged in some really shady behavior directed at Let’s Encrypt [1]. At that point, decided there was no way I was going to keep rewarding Comodo with my business — not even a measly ten bucks’ worth. And now I couldn’t be happier I switched to Let’s Encrypt. Automatic renewals mean no more working through the partially-manual, email-based process we had to use with Comodo. And free+automated means I don’t think twice about using https on every new subdomain. Really, I don’t think at all about https anymore; it just works. [1]: https://news.ycombinator.com/item?id=11964583 https://news.ycombinator.com/item?id=11964583