2 ms·

> many devs, don't [...] have the wherewithal to deal with SSL. I can buy this for a non-dev clicking "Install Wordpress" in a legacy cpanel of a cheap shared

> many devs, don't [...] have the wherewithal to deal with SSL. I can buy this for a non-dev clicking "Install Wordpress" in a legacy cpanel of a cheap shared web host (though in that case the web host should be setting up certs automatically for them), but what exactly is complicated about setting up certs for a dev? https://certbot.eff.org/ https://certbot.eff.org/ holds your hand through the entire ~30 second process. It's simpler than most other tasks a dev needs to do while setting up a website.

pbhjpbhj 8y ago
I use a cheap shared web host. My current and previous host both have LetsEncrypt implementations that take a couple of clicks. The former one was just default cpanel I think. It is difficult if you want to understand the process, though no more so than, say, using Git IMO. In short cpanel and other shared host panels make it as easy as the clicky-clicky Wordpress install
- jfk13 8y ago
  > It is difficult if you want to understand the process, though no more so than, say, using Git IMO. Given how arcane and confusing anything beyond the most basic Git usage can get, that's hardly a glowing endorsement. :)
  - lucideer 8y ago
    I agree, I found that comparison a bit odd. Certbot is many many orders of magnitude easier to use than Git, and that's even if you need to "use" it beyond the run-once-and-forget standard use-case
foepys 8y ago
Sometimes it comes down to whether user-generated content with externally linked resources is allowed on the site. E.g. forums often allows embedding images by users and because users don't care about HTTP or HTTPS and only copy the image link from somewhere, you will end up with "mixed content" warnings and broken "locks" in the browser address bar all over the place. The current alternative is to simply use HTTP, which doesn't yield any warnings. When Chrome will mark all non-HTTPS sites as insecure this will change, hopefully.
- lucideer 8y ago
  This is a very good point, but as you say and the article states, the lack of warnings for this is changing. There's also the obvious question of having user login/signup on a non-HTTPS site in the first place (pseudo-anonymous user accounts or otherwise).
sethammons 8y ago
certbot has failed continually on my DO instance. It cannot update my cert on cron. I have to manually update my cert when I remember to do so. In fact, I had forgotten to do this for the last several months, so my site gets to display a nice scary warning for anyone who might venture forth and try https. I've searched how to fix it and nothing comes up. The site is static html and I've considered just removing https.
- jhomedall 8y ago
  What are the contents of your crontab? Anything in the certbot logs? What server software are you running?
swebs 8y ago
>but what exactly is complicated about setting up certs for a dev? Seeing as how he mentioned AWS, it's a bit more complicated if you have a cluster of servers that are automatically managed. You have to set up a reverse proxy and integrate that into your cloud provider's workflow.
contras1970 8y ago
> what exactly is complicated about setting up certs for a dev? it may not be complicated but you cannot beat doing nothing.

pbhjpbhj 8y ago

I use a cheap shared web host. My current and previous host both have LetsEncrypt implementations that take a couple of clicks. The former one was just default cpanel I think. It is difficult if you want to understand the process, though no more so than, say, using Git IMO. In short cpanel and other shared host panels make it as easy as the clicky-clicky Wordpress install

jfk13 8y ago
> It is difficult if you want to understand the process, though no more so than, say, using Git IMO. Given how arcane and confusing anything beyond the most basic Git usage can get, that's hardly a glowing endorsement. :)
- lucideer 8y ago
  I agree, I found that comparison a bit odd. Certbot is many many orders of magnitude easier to use than Git, and that's even if you need to "use" it beyond the run-once-and-forget standard use-case

foepys 8y ago

Sometimes it comes down to whether user-generated content with externally linked resources is allowed on the site. E.g. forums often allows embedding images by users and because users don't care about HTTP or HTTPS and only copy the image link from somewhere, you will end up with "mixed content" warnings and broken "locks" in the browser address bar all over the place. The current alternative is to simply use HTTP, which doesn't yield any warnings. When Chrome will mark all non-HTTPS sites as insecure this will change, hopefully.

lucideer 8y ago
This is a very good point, but as you say and the article states, the lack of warnings for this is changing. There's also the obvious question of having user login/signup on a non-HTTPS site in the first place (pseudo-anonymous user accounts or otherwise).

sethammons 8y ago

certbot has failed continually on my DO instance. It cannot update my cert on cron. I have to manually update my cert when I remember to do so. In fact, I had forgotten to do this for the last several months, so my site gets to display a nice scary warning for anyone who might venture forth and try https. I've searched how to fix it and nothing comes up. The site is static html and I've considered just removing https.

jhomedall 8y ago
What are the contents of your crontab? Anything in the certbot logs? What server software are you running?

swebs 8y ago

>but what exactly is complicated about setting up certs for a dev? Seeing as how he mentioned AWS, it's a bit more complicated if you have a cluster of servers that are automatically managed. You have to set up a reverse proxy and integrate that into your cloud provider's workflow.

contras1970 8y ago

> what exactly is complicated about setting up certs for a dev? it may not be complicated but you cannot beat doing nothing.