3 ms·

I'm in the middle of automating certificate renewals for my company and I really haven't thought about anything except Let's Encrypt. In fact I was surprised t

• stephenr 8y ago
  I was pleasantly surprised to discover a few other CAs support the ACME protocol, however it’s either a free cert without support for SANs or certificates that require manual approval via a web control panel. I’m not against paying for a cert but don’t make it much harder than LetsEncrypt to use it.
• tialaramex 8y ago
  APIs to handle obtaining and deploying certificates weren't new with ACME. What's new in ACME is the stuff that lets you automate proof of control of a name. There's a fun thread on m.d.s.policy where I'm explaining this and Peter Guttman (who does some work in this area) starts out asserting that this feature is so unimportant and stupid that you could easily do it with other existing protocols, when that argument was destroyed he switches to claiming nobody ever wants to do such a thing, and eventually he retreated to the idea that the Web PKI is an insignificant application anyway and so it doesn't matter. The funniest part is that this all happened not when Let's Encrypt was an untried experiment but months into deployment when it was already a huge success. It was the equivalent of that moment when an elderly relative informs you that they can't see these new fangled computers ever amounting to much.