8 ms·

I buy them. I don't like paying for them, but I want a certificate I know will just work for years without having to run certbot or one of its clones on my serv

by byuu 8y ago

I buy them. I don't like paying for them, but I want a certificate I know will just work for years without having to run certbot or one of its clones on my server. Well, that and LE didn't yet allow wildcard certs when I bought mine. They've already dropped their maximum validity from three to two years though, so I'll probably throw in the towel when they further reduce their validity to less than six months.

jbverschoor 8y ago
Well that's nice. But that mean you'll have to manually buy, upgrade install and test them. I have better things to do.
- AnIdiotOnTheNet 8y ago
  Takes about 5 minutes of time. It really isn't a big deal.
  - r3bl 8y ago
    So does setting up Let's Encrypt + automating the renewal, and you don't have to spend a dollar in those 5 minutes.
  - srwx 8y ago
    5 minutes once forever is even less of a big deal.
Kaspar0v 8y ago
A certificate that last for years... That's exactly how you end up with a certificate that expired and no one realized. An automated process is a way more reliable.
- byuu 8y ago
  Until the automated process breaks. I've encountered more "invalid certificate" warnings on Let's Encrypt sites than any others.
mhaberl 8y ago
Let's Encrypt certs are valid for 90 days. There are 2 reasons: 1. To limit damage from key compromise and mis-issuance 2. To encourage automation. What is the issue with running the certbot on your server? It's not like you have to run it manually. Here are official reasons: https://letsencrypt.org/2015/11/09/why-90-days.html https://letsencrypt.org/2015/11/09/why-90-days.html P.S. Wildcard certs are available for almost a year now: https://community.letsencrypt.org/t/acme-v2-production-environment-wildcards/55578 https://community.letsencrypt.org/t/acme-v2-production-envir...
- kortilla 8y ago
  The issue might be executing 3rd party code on a server.
  - JulienSchmidt 8y ago
    ACME is an open protocol (and very soon it will be an IETF Internet Standard too). There are many alternative implementations. Just find one you trust. We actually did our own DNS-based implementation for our infrastructure.
    - byuu 8y ago
      I don't want to run someone else's code on my server just for this (the default certbot wants root access too, yikes), nor do I want to analyze someone else's implementation before running their code, and I sure as heck don't have the time, patience, or interest to write my own implementation of ACME just for the one service that uses it. I want to go to a website, have it tell me to put a string into a meta tag or DNS TXT record, and then save the key it returns on my box. Then I want to forget about it for the next 2-3 years. Honestly I don't even want to do that. I want my nameserver to generate a DANE/DNSSEC record for me automatically, and for browsers to honor that. It isn't like domain verification is any more secure than a DNSSEC record would be.
      - JulienSchmidt 8y ago

by byuu 8y ago

jbverschoor 8y ago

Well that's nice. But that mean you'll have to manually buy, upgrade install and test them. I have better things to do.

AnIdiotOnTheNet 8y ago
Takes about 5 minutes of time. It really isn't a big deal.
- r3bl 8y ago
  So does setting up Let's Encrypt + automating the renewal, and you don't have to spend a dollar in those 5 minutes.
- srwx 8y ago
  5 minutes once forever is even less of a big deal.

Kaspar0v 8y ago

A certificate that last for years... That's exactly how you end up with a certificate that expired and no one realized. An automated process is a way more reliable.

byuu 8y ago
Until the automated process breaks. I've encountered more "invalid certificate" warnings on Let's Encrypt sites than any others.

mhaberl 8y ago

Let's Encrypt certs are valid for 90 days. There are 2 reasons: 1. To limit damage from key compromise and mis-issuance 2. To encourage automation. What is the issue with running the certbot on your server? It's not like you have to run it manually. Here are official reasons: https://letsencrypt.org/2015/11/09/why-90-days.html https://letsencrypt.org/2015/11/09/why-90-days.html P.S. Wildcard certs are available for almost a year now: https://community.letsencrypt.org/t/acme-v2-production-environment-wildcards/55578 https://community.letsencrypt.org/t/acme-v2-production-envir...

kortilla 8y ago
The issue might be executing 3rd party code on a server.
- JulienSchmidt 8y ago
  ACME is an open protocol (and very soon it will be an IETF Internet Standard too). There are many alternative implementations. Just find one you trust. We actually did our own DNS-based implementation for our infrastructure.
  - byuu 8y ago
    I don't want to run someone else's code on my server just for this (the default certbot wants root access too, yikes), nor do I want to analyze someone else's implementation before running their code, and I sure as heck don't have the time, patience, or interest to write my own implementation of ACME just for the one service that uses it. I want to go to a website, have it tell me to put a string into a meta tag or DNS TXT record, and then save the key it returns on my box. Then I want to forget about it for the next 2-3 years. Honestly I don't even want to do that. I want my nameserver to generate a DANE/DNSSEC record for me automatically, and for browsers to honor that. It isn't like domain verification is any more secure than a DNSSEC record would be.
    - JulienSchmidt 8y ago