3 ms·

I'm curious as well. My intuition would be that it's not a concern, since servers already keep their private keys stored locally in order to be able to communic

I'm curious as well. My intuition would be that it's not a concern, since servers already keep their private keys stored locally in order to be able to communicate with clients anyway? Being able to update them doesn't really seem to make things any different. But I feel like I could be missing something/not have thought through it properly. (I imagine security implications can get more complicated if a different server decrypts traffic vs. processes it, etc.)

revvx 8y ago
The "manual" process used previously by the company already involved some form of automation, so it was more about trusting CertBot not to do anything horrendous. But now that you mention it, I wonder what's the opinion of security experts like tptacek on cert renewal automation.
- inflatableDodo 8y ago
  We could attempt a summoning. Quick, make a wildly inaccurate claim about the correct way to implement an encryption library.