3 ms·

That's an interesting fresh idea in the "auto-renew TLS certs" market. (And the website looks superb!) A few thoughts: - If I were a service provider I wouldn'

That's an interesting fresh idea in the "auto-renew TLS certs" market. (And the website looks superb!) A few thoughts: - If I were a service provider I wouldn't wanna be dependent on a third party service for something as basic as TLS certs. I'm not an expert in your domain but to me this looks like something that could happily coexist as a service with a self-hostable (possibly FOSS) option (since the convenience advantage of a service is still there). - Security: Can you read my customers' traffic? (A self-hosted option could also help with this for high-sensitivity use cases). - What about rate limits? My customers could be in a situation where the standard LE rate limits are already pretty tight. Can I (and subsequently my customers) see/manage how much quota AutoSSL is using?

coderobe 7y ago
>- Security: Can you read my customers' traffic? Yes, anything that (re)terminates TLS will be able to - including this - and there is no way around it short of hosting it on-prem. Marketing it as end-to-end security the way the author is doing is ... wrong.
bauruine 7y ago
>Can you read my customers' traffic? Yes they can. >A self-hosted option https://letsencrypt.org/docs/client-options/ https://letsencrypt.org/docs/client-options/ Aren't those enough options?
- t0astbread 7y ago
  Are those fit for the purpose AutoSSL was designed for? Looking over that list it seems like those clients were all built for managing a single (or few) certificates just for yourself. AutoSSL was built for managing your customers' certs (i.e. a lot of them) and I have the feeling trying to use conventional ACME clients (like certbot) in this automated fashion could turn into a shitshow rather quickly.
  - bauruine 7y ago
    Read the readme of https://github.com/GUI/lua-resty-auto-ssl/blob/master/README.md https://github.com/GUI/lua-resty-auto-ssl/blob/master/README... And tell me what this service can do what resty-auto-ssl can't. And there are a lot of different implementations for every language because it is easy.
  - petronio 7y ago
    I've had good luck with dehydrated (https://github.com/lukas2511/dehydrated https://github.com/lukas2511/dehydrated) It takes a file with a list of domains to check and you can write your own hooks to handle the DNS management and certificate deployment however you want.
AtlasBarfed 7y ago
COmpanies buy "security" "turnkey" solutions all the time, why would this be anything different? All that networking hardware terminating SSL between external and internal traffic can also read all a company's traffic, but I guess Cisco or some chinese manufacturer is more trustworthy...right? ... not affliated with the OP at all. Some of the security groups at major fort-500 companies I've worked at were run by people that could powerpoint well, graduated from surfing suitcase schools, and showed no awareness of even mass media security failings (heartbleed). You'd think these divisions would have extremely smart PhD level security folks that could follow the basics of what the attacks used, but they were all just people that did vendor RFPs, made dumb policies (8 char max password, only use approved versions of software that were already out of date and had known vulnerabilities, internal password change site wouldn't show in Chrome because the cipher suite was hopelessly compromised)
- t0astbread 7y ago
  A difference between on-prem solutions like networking hardware and outsourced services is that the on-prem solution doesn't phone home (at least not the processed data hopefully). Different idea though: Shouldn't GDPR data processing agreements cover these sorts of cases?

coderobe 7y ago

>- Security: Can you read my customers' traffic? Yes, anything that (re)terminates TLS will be able to - including this - and there is no way around it short of hosting it on-prem. Marketing it as end-to-end security the way the author is doing is ... wrong.

bauruine 7y ago

>Can you read my customers' traffic? Yes they can. >A self-hosted option https://letsencrypt.org/docs/client-options/ https://letsencrypt.org/docs/client-options/ Aren't those enough options?

t0astbread 7y ago
Are those fit for the purpose AutoSSL was designed for? Looking over that list it seems like those clients were all built for managing a single (or few) certificates just for yourself. AutoSSL was built for managing your customers' certs (i.e. a lot of them) and I have the feeling trying to use conventional ACME clients (like certbot) in this automated fashion could turn into a shitshow rather quickly.
- bauruine 7y ago
  Read the readme of https://github.com/GUI/lua-resty-auto-ssl/blob/master/README.md https://github.com/GUI/lua-resty-auto-ssl/blob/master/README... And tell me what this service can do what resty-auto-ssl can't. And there are a lot of different implementations for every language because it is easy.
- petronio 7y ago
  I've had good luck with dehydrated (https://github.com/lukas2511/dehydrated https://github.com/lukas2511/dehydrated) It takes a file with a list of domains to check and you can write your own hooks to handle the DNS management and certificate deployment however you want.

AtlasBarfed 7y ago

COmpanies buy "security" "turnkey" solutions all the time, why would this be anything different? All that networking hardware terminating SSL between external and internal traffic can also read all a company's traffic, but I guess Cisco or some chinese manufacturer is more trustworthy...right? ... not affliated with the OP at all. Some of the security groups at major fort-500 companies I've worked at were run by people that could powerpoint well, graduated from surfing suitcase schools, and showed no awareness of even mass media security failings (heartbleed). You'd think these divisions would have extremely smart PhD level security folks that could follow the basics of what the attacks used, but they were all just people that did vendor RFPs, made dumb policies (8 char max password, only use approved versions of software that were already out of date and had known vulnerabilities, internal password change site wouldn't show in Chrome because the cipher suite was hopelessly compromised)

t0astbread 7y ago
A difference between on-prem solutions like networking hardware and outsourced services is that the on-prem solution doesn't phone home (at least not the processed data hopefully). Different idea though: Shouldn't GDPR data processing agreements cover these sorts of cases?