4 ms·

I have a couple of Let's Encrypt certs for some subdomains, but honestly I've left some others on plain HTTP simply through laziness. LE imposes a requirement

I have a couple of Let's Encrypt certs for some subdomains, but honestly I've left some others on plain HTTP simply through laziness. LE imposes a requirement to renew certificates every 90 days, which is a nuisance. Logging-in, finding my process crib-sheet, running the update requests, updating DNS records, running the validation requests, shifting certs to servers, restarting services... all because the LE project wants to evangelise short certificate lifespans, which seems to have been bolted onto the original goal of 'encrypt all the things' because of someone's personal conviction. I do wish they'd offer a longer optional lifespan. Even 365 days would be a huge improvement. Until then I really can't recommend it to less-technically-inclined colleagues; I just tell them go and buy a one-year cert from Gandi, chuck it into the ssl directory and forget about it until the renewal reminder arrives 11 months later.

FormFollowsFunc 9y ago
It’s not too hard to setup a daily cronjob to renew automatically.
- thunfischbrot 9y ago
  I have found https://github.com/Neilpang/acme.sh https://github.com/Neilpang/acme.sh to be incredibly easy to deploy in several different configurations.
thunfischbrot 9y ago
It's almost the same amount of work to deploy a one-year cert as it is to set up an automatic LE cert which is going to save you from renewing the one-year cert each year, and forgetting etc.
stephenr 9y ago
> which is a nuisance. Logging-in, finding my process crib-sheet, running the update requests, updating DNS records, running the validation requests, shifting certs to servers, restarting services You're doing it wrong. There are many ways to use the ACME protocol (and Lets Encrypt), I think pretty much anyone will agree this is simply the wrong way to do it. The ACME protocol is an API (as opposed to the CA's "upload a manually created, signed CSR, then wait for an HTML email and click the link in it and then download this file" process) so that it can be automated, and hands-off.

FormFollowsFunc 9y ago

It’s not too hard to setup a daily cronjob to renew automatically.

thunfischbrot 9y ago
I have found https://github.com/Neilpang/acme.sh https://github.com/Neilpang/acme.sh to be incredibly easy to deploy in several different configurations.

thunfischbrot 9y ago

It's almost the same amount of work to deploy a one-year cert as it is to set up an automatic LE cert which is going to save you from renewing the one-year cert each year, and forgetting etc.

stephenr 9y ago

> which is a nuisance. Logging-in, finding my process crib-sheet, running the update requests, updating DNS records, running the validation requests, shifting certs to servers, restarting services You're doing it wrong. There are many ways to use the ACME protocol (and Lets Encrypt), I think pretty much anyone will agree this is simply the wrong way to do it. The ACME protocol is an API (as opposed to the CA's "upload a manually created, signed CSR, then wait for an HTML email and click the link in it and then download this file" process) so that it can be automated, and hands-off.