3 ms·

This is what success looks like. Thanks for making TLS easy and free.

• paulmd 9y ago
  I work at a nonprofit and I've had great success pushing LE there. We used to have an org-wide wildcard certificate and we'd buy additional certs as necessary, and at first there was some serious skepticism about "free certs" even though I pointed out the significant players behind it. The IT people are now on board and looking to spread it to more projects. It's been great for us in many respects. We no longer have certificates shared between servers, which removes the vulnerability to DROWN and some other problems. We also tend to serve multiple domains from a single IP, which requires a cert that covers all domains. LE lets us trivially get a cert to cover multiple domains, which would be especially expensive with project managers who can't make up their minds on what domains they want to use. And, we get the usual benefits of LE - effective forward secrecy in case someone obtains a single key/etc. There was a little bit of pain at first getting the renewal infrastructure set up properly. My setup still isn't quite perfect, so far the standalone certbot option is the least painful for me. I have a cronjob which shuts down httpd, starts up certbot-standalone, does the renew, and restarts httpd, so we are down for an additional ~5 seconds per day while we renew. Not the end of the world for our usage.
  • stephenr 9y ago
    Depending on what your non-profit is in support of, Koalephant (my company) may be able to provide some pro-bono hours to assist/advice on that 'not quite perfect' setup, if that's at all of interest to you. My email is in my profile if you want to get in touch.