5 ms·

Automated renewal with letsencrypt is a thing. Blaming this on the shutdown rather than on not taking appropriate care to do this more robustly? Meh.

jlarocco 8y ago
Techcrunch doesn't load for me after I started blocking cookies, but is it about the renewal or paying for it? Automation doesn't matter if the spending isn't approved.
- umanwizard 8y ago
  The article sort of implies both. > because so many federal workers have been sent home on unpaid leave — or worse, working without pay but trying to fill in for most of their furloughed department — expired certificates aren’t getting renewed. Renewing certificates doesn’t take much time or effort — sometimes just a click of a mouse. But some do cost money, and during a government shutdown there isn’t any. My personal guess is that the author of the article doesn't know which it is.
- smsm42 8y ago
  I am usually all for privatization but having .gov CA and issuing new certs without any spending sounds like something that would be a sensible idea even for the most hardcore libertarian. I don't see why government must buy certificates in retail instead of just having its own authority (which it has anyway in .gov domain btw).
pavlov 8y ago
The employees tasked with clicking the "Renew Certificate" button every X months probably have no idea how they'd go about that. As a contracting project, I imagine it would be pretty expensive to upgrade every single website of the US federal government to use Let's Encrypt. How many different operating systems and web server setups there must be?
- tomohawk 8y ago
  My point is that said employees / contractors should have a better plan than having to be there at a certain time to push a button. That's planning for failure. What if the contract has a problem? It happens. What if the approving official is out sick for a month? It happens. Not knowing how to set these things up? I don't really think that's an excuse. This should be addressed in the requirements.
  - pavlov 8y ago
    Federal agencies have made websites for the past 25 years. Let's Encrypt launched in 2016. It's bleeding-edge technology as far as public sector requirements go.
    - deleted 8y ago
      [deleted]
    - beat 8y ago
      Methinks a lot of the eyerolling about not using Let's Encrypt is coming from people who have never touched a real legacy system in their lives.
    - tomohawk 8y ago
      Specifying requirements for uptime is not new. Federal agencies have many failure modes that are different than private sector, but those who work there know about them. Purchasing a 1 year cert can be extremely challenging, depending on the agency, due to procurement rules, etc. For such an important part of a site to be neglected when the above is known - an eye roll is about all the respect that can be afforded to it. Source: I've worked in and with the federal government for more than 25 years.
- beat 8y ago
  Done fed-wide, it would make more sense to set up the federal government as a top-level certificate authority, and build a LetsEncryptAlike that does the same thing.
merlincorey 8y ago
> Automated renewal with letsencrypt is a thing. The article mentions it is a thing in the following cases: """Any website that’s hosted on cloud.gov, search.gov or federalist.18f.gov won’t go down as they rely on Let’s Encrypt certificates that automatically renew every three months."""
jonas21 8y ago
Not using Let's Encrypt automated renewal isn't necessarily due to a lack of care. Some of the sites listed use EV certificates, which aren't supported by Let's Encrypt. And using Let's Encrypt for automated renewal comes with risks of its own. Note, for example, that very few of the "major sponsors" listed on the Let's Encrypt website use Let's Encrypt for their own sites.
- jteppinette 8y ago
  What risks? Major sponsors not using Let’s Encrypt is most likely due to marketing departments using third party software running the company site. I don’t know why, but marketing usually doesn’t want engineering anywhere near their public sites...
  - dvtrn 8y ago
    Major sponsors not using Let’s Encrypt is most likely due to marketing departments using third party software running the company site. Immensely curious how you came about this conclusion of all the possibilities available
    - jteppinette 8y ago
      My experience working at tech companies. Also, not assuming that sponsors of Let’s Encrypt don’t trust their certificates.
  - res0nat0r 8y ago
    I currently work for a fortune 5 company, we're not using letsencrypt yet because my team currently doesn't have the manpower to migrate our automation and code to something such as this. Note that I want to move to LE as soon as possible, but we're not on it yet, and folks citing that something like this is easily fixable in a snap just isn't informed on how things actually are working in real world environments.
    - noir_lord 8y ago
setum 8y ago
> But some do cost money, and during a government shutdown there isn’t any.
CydeWeys 8y ago
Automated renewal only works so long as your servers doing said renewal continue working. This is by no means guaranteed. How long do you think the average company's IT infrastructure would continue working if all employees instantly dropped dead? With no one to respond to any issues that crop up, and nothing that isn't 100% automated happening at all?
- jammygit 8y ago
  I was wondering something for a project I'm considering. If I build a web app for somebody and move on, am I even doing them a favour unless I maintain it for years too? Not experienced enough to have an answer
  - umanwizard 8y ago
    If it's a job, then that's their problem, just like how if I pay someone for a car, I still have to get the oil changed forever. If you're doing it for free as a favor for a non-technical friend then yes, almost certainly you will need to do at least some maintenance work in the future.
  - rhizome 8y ago
    That's what maintenance contracts are for.
- egwor 8y ago
  Most of the stuff that I wrote in my last job was designed to keep going whatever. I didn't want to be disturbed with issues and as a tiny team we automated and fixed everything that was likely to cause us issues. I left >6mo go and it is still running without issues now. If a box dies it flips to another box on another data centre etc.
  - CydeWeys 8y ago
    That's not truly unattended though, as there's still plenty of people working in that datacenter keeping things up and running. It's easy to have services working unattended for a long time when someone else is responsible for maintaining the hardware; even better if they're maintaining the OS updates too. Now if all the datacenter staff are furloughed too ... the first usually trivial issue might take everything down.

jlarocco 8y ago

Techcrunch doesn't load for me after I started blocking cookies, but is it about the renewal or paying for it? Automation doesn't matter if the spending isn't approved.

umanwizard 8y ago
The article sort of implies both. > because so many federal workers have been sent home on unpaid leave — or worse, working without pay but trying to fill in for most of their furloughed department — expired certificates aren’t getting renewed. Renewing certificates doesn’t take much time or effort — sometimes just a click of a mouse. But some do cost money, and during a government shutdown there isn’t any. My personal guess is that the author of the article doesn't know which it is.
smsm42 8y ago
I am usually all for privatization but having .gov CA and issuing new certs without any spending sounds like something that would be a sensible idea even for the most hardcore libertarian. I don't see why government must buy certificates in retail instead of just having its own authority (which it has anyway in .gov domain btw).

pavlov 8y ago

The employees tasked with clicking the "Renew Certificate" button every X months probably have no idea how they'd go about that. As a contracting project, I imagine it would be pretty expensive to upgrade every single website of the US federal government to use Let's Encrypt. How many different operating systems and web server setups there must be?

tomohawk 8y ago
My point is that said employees / contractors should have a better plan than having to be there at a certain time to push a button. That's planning for failure. What if the contract has a problem? It happens. What if the approving official is out sick for a month? It happens. Not knowing how to set these things up? I don't really think that's an excuse. This should be addressed in the requirements.
- pavlov 8y ago
  Federal agencies have made websites for the past 25 years. Let's Encrypt launched in 2016. It's bleeding-edge technology as far as public sector requirements go.
  - deleted 8y ago
    [deleted]
  - beat 8y ago
    Methinks a lot of the eyerolling about not using Let's Encrypt is coming from people who have never touched a real legacy system in their lives.
  - tomohawk 8y ago
    Specifying requirements for uptime is not new. Federal agencies have many failure modes that are different than private sector, but those who work there know about them. Purchasing a 1 year cert can be extremely challenging, depending on the agency, due to procurement rules, etc. For such an important part of a site to be neglected when the above is known - an eye roll is about all the respect that can be afforded to it. Source: I've worked in and with the federal government for more than 25 years.
beat 8y ago
Done fed-wide, it would make more sense to set up the federal government as a top-level certificate authority, and build a LetsEncryptAlike that does the same thing.

merlincorey 8y ago

> Automated renewal with letsencrypt is a thing. The article mentions it is a thing in the following cases: """Any website that’s hosted on cloud.gov, search.gov or federalist.18f.gov won’t go down as they rely on Let’s Encrypt certificates that automatically renew every three months."""

jonas21 8y ago

Not using Let's Encrypt automated renewal isn't necessarily due to a lack of care. Some of the sites listed use EV certificates, which aren't supported by Let's Encrypt. And using Let's Encrypt for automated renewal comes with risks of its own. Note, for example, that very few of the "major sponsors" listed on the Let's Encrypt website use Let's Encrypt for their own sites.

jteppinette 8y ago
What risks? Major sponsors not using Let’s Encrypt is most likely due to marketing departments using third party software running the company site. I don’t know why, but marketing usually doesn’t want engineering anywhere near their public sites...
- dvtrn 8y ago
  Major sponsors not using Let’s Encrypt is most likely due to marketing departments using third party software running the company site. Immensely curious how you came about this conclusion of all the possibilities available
  - jteppinette 8y ago
    My experience working at tech companies. Also, not assuming that sponsors of Let’s Encrypt don’t trust their certificates.
- res0nat0r 8y ago
  I currently work for a fortune 5 company, we're not using letsencrypt yet because my team currently doesn't have the manpower to migrate our automation and code to something such as this. Note that I want to move to LE as soon as possible, but we're not on it yet, and folks citing that something like this is easily fixable in a snap just isn't informed on how things actually are working in real world environments.
  - noir_lord 8y ago

setum 8y ago

> But some do cost money, and during a government shutdown there isn’t any.

CydeWeys 8y ago

Automated renewal only works so long as your servers doing said renewal continue working. This is by no means guaranteed. How long do you think the average company's IT infrastructure would continue working if all employees instantly dropped dead? With no one to respond to any issues that crop up, and nothing that isn't 100% automated happening at all?

jammygit 8y ago
I was wondering something for a project I'm considering. If I build a web app for somebody and move on, am I even doing them a favour unless I maintain it for years too? Not experienced enough to have an answer
- umanwizard 8y ago
  If it's a job, then that's their problem, just like how if I pay someone for a car, I still have to get the oil changed forever. If you're doing it for free as a favor for a non-technical friend then yes, almost certainly you will need to do at least some maintenance work in the future.
- rhizome 8y ago
  That's what maintenance contracts are for.
egwor 8y ago
Most of the stuff that I wrote in my last job was designed to keep going whatever. I didn't want to be disturbed with issues and as a tiny team we automated and fixed everything that was likely to cause us issues. I left >6mo go and it is still running without issues now. If a box dies it flips to another box on another data centre etc.
- CydeWeys 8y ago
  That's not truly unattended though, as there's still plenty of people working in that datacenter keeping things up and running. It's easy to have services working unattended for a long time when someone else is responsible for maintaining the hardware; even better if they're maintaining the OS updates too. Now if all the datacenter staff are furloughed too ... the first usually trivial issue might take everything down.