5 ms·

Let's Encrypt certs are valid for 90 days. There are 2 reasons: 1. To limit damage from key compromise and mis-issuance 2. To encourage automation. What is

Let's Encrypt certs are valid for 90 days. There are 2 reasons: 1. To limit damage from key compromise and mis-issuance 2. To encourage automation. What is the issue with running the certbot on your server? It's not like you have to run it manually. Here are official reasons: https://letsencrypt.org/2015/11/09/why-90-days.html https://letsencrypt.org/2015/11/09/why-90-days.html P.S. Wildcard certs are available for almost a year now: https://community.letsencrypt.org/t/acme-v2-production-environment-wildcards/55578 https://community.letsencrypt.org/t/acme-v2-production-envir...

kortilla 8y ago
The issue might be executing 3rd party code on a server.
- JulienSchmidt 8y ago
  ACME is an open protocol (and very soon it will be an IETF Internet Standard too). There are many alternative implementations. Just find one you trust. We actually did our own DNS-based implementation for our infrastructure.
  - byuu 8y ago
    I don't want to run someone else's code on my server just for this (the default certbot wants root access too, yikes), nor do I want to analyze someone else's implementation before running their code, and I sure as heck don't have the time, patience, or interest to write my own implementation of ACME just for the one service that uses it. I want to go to a website, have it tell me to put a string into a meta tag or DNS TXT record, and then save the key it returns on my box. Then I want to forget about it for the next 2-3 years. Honestly I don't even want to do that. I want my nameserver to generate a DANE/DNSSEC record for me automatically, and for browsers to honor that. It isn't like domain verification is any more secure than a DNSSEC record would be.
    - JulienSchmidt 8y ago
      Take a look at https://github.com/joohoi/acme-dns/ https://github.com/joohoi/acme-dns/ (which of course still requires trust in the client lib) We do something similar, although not through a REST API. We handle all this cert management centralized on one server, which publishes the DNS records for DNS verification etc. On our other servers is then just a simple script that periodically checks if the certs on the machine are near the expiry date and if so pulls a new one from the central system.
    - Ayesh 8y ago
      ACME protocol is fairly straight forward to implement, and you can easily write your own implementation with existing code (OpenSSL, Apache/nginx, etc). With many commercial registrar's, although they offer a valid and long certificate, their technical aspects aren't very good. Many CAs don't support ECC certificates, the must-staple flag or CT SCTs embedded in the certificate. I work a lot with web PKI, and every time I have to deal with a CA that's not LE or Digicert, I sigh out loud.
deleted 8y ago
[deleted]

kortilla 8y ago

The issue might be executing 3rd party code on a server.

JulienSchmidt 8y ago
ACME is an open protocol (and very soon it will be an IETF Internet Standard too). There are many alternative implementations. Just find one you trust. We actually did our own DNS-based implementation for our infrastructure.
- byuu 8y ago
  I don't want to run someone else's code on my server just for this (the default certbot wants root access too, yikes), nor do I want to analyze someone else's implementation before running their code, and I sure as heck don't have the time, patience, or interest to write my own implementation of ACME just for the one service that uses it. I want to go to a website, have it tell me to put a string into a meta tag or DNS TXT record, and then save the key it returns on my box. Then I want to forget about it for the next 2-3 years. Honestly I don't even want to do that. I want my nameserver to generate a DANE/DNSSEC record for me automatically, and for browsers to honor that. It isn't like domain verification is any more secure than a DNSSEC record would be.
  - JulienSchmidt 8y ago
    Take a look at https://github.com/joohoi/acme-dns/ https://github.com/joohoi/acme-dns/ (which of course still requires trust in the client lib) We do something similar, although not through a REST API. We handle all this cert management centralized on one server, which publishes the DNS records for DNS verification etc. On our other servers is then just a simple script that periodically checks if the certs on the machine are near the expiry date and if so pulls a new one from the central system.
  - Ayesh 8y ago
    ACME protocol is fairly straight forward to implement, and you can easily write your own implementation with existing code (OpenSSL, Apache/nginx, etc). With many commercial registrar's, although they offer a valid and long certificate, their technical aspects aren't very good. Many CAs don't support ECC certificates, the must-staple flag or CT SCTs embedded in the certificate. I work a lot with web PKI, and every time I have to deal with a CA that's not LE or Digicert, I sigh out loud.

deleted 8y ago

[deleted]