5 ms·

Instructions are here: https://certbot.eff.org/ https://certbot.eff.org/ I don't know how it could possibly be any simpler.

by chungy 7y ago

onion-soup 7y ago
While I appreciate the efforts of certbot to make it as user-friendly as possible I still find this state of things unforgivable. I don't know where it went wrong so that today a developer must spend time learning and tweaking a low-level encryption tools. I'm just saying https will never be 100% unless it becomes a baked-in feature of any hosting.
- cm2187 7y ago
  Starting with baking ACMEv2 in the major webservers (apache, IIS, etc).
  - deleted 7y ago
    [deleted]
  - Jaruzel 7y ago
    If Microsoft baked in Auto-cert-install in to IIS that allowed you to cherry pick a provider, and/or just select their own free CA, that'd really solve the problem for Windows based web servers. In my experience CertBot/ACME type renewal doesn't work reliably for Windows/IIS.
- regecks 7y ago
  Certbot, and most other standalone ACME clients, are just stop-gaps. The end game is first-party support for automatic HTTPS in all web (and other) servers. It is happening (e.g. mod_md), it's just going to take time. For example, to get it packaged for all distributions. For shared hosting, if you ignore the few providers at the top who are either CAs (e.g. GoDaddy) or are in contracts with CAs (e.g. Namecheap), the overwhelming majority of them are already providing free and automatic SSL for all hosted domains.
  - majewsky 7y ago
    > The end game is first-party support for automatic HTTPS in all web (and other) servers. There's still a need for certbot et al when you have multiple services (e.g. web and mail and XMPP) running on a single domain name. In fact, I actively avoid servers that insist on doing ACME themselves because it breaks my unified ACME process.
- jbverschoor 7y ago
  It’s for ops. Not dev
- thenewnewguy 7y ago
  Developers don't need to, unless they're the ones hosting your website. In which case, yes, I expect them to be able to configure web hosting software.
  - hrktb 7y ago
    This is sadly not the case yet in many not so edge cases. For instance Heroku still doesn't provide straightforward support for wildcard domains under SSL: https://devcenter.heroku.com/articles/understanding-ssl-on-heroku https://devcenter.heroku.com/articles/understanding-ssl-on-h... There is myriad of other cases, basically every time you diverge a bit from the 80% path, you're in for a treat and will deal with all the intricacies of SSL management.
- AnIdiotOnTheNet 7y ago
  What is the value in HTTPS being 100%? That seems silly to me. Many many things do not have any need for encryption.
  - tialaramex 7y ago
    Most things would benefit from encryption. Even if you don't need integrity protection, and you don't have any need of privacy, and you don't care about authenticating your peers you still want encryption because otherwise middleboxes ossify everything. If the middlebox can't see inside your flow because it's encrypted it can't object to whatever new thing it's scared of this time whether that's HD video or a new HTML tag.
    - AnIdiotOnTheNet 7y ago
      Not a significant issue in practice as far as I can tell. I deliver text over the internet, and sometimes binaries over the internet, and it happens very fast because there is no useless cruft in the process to satisfy some security twonk's paranoid delusions.
- kbr2000 7y ago
  A management fad called dev-ops is what went wrong, before you could count on your sysadmin to take care of that :) Apart from that, not everything always makes sense to use in production without a good level of understanding --- and might otherwise lead to, for example, a false sense of security.
elcomet 7y ago
It is simple for a one-server website. When you're on Alexa 1M, you certainly have a load balancer, multiple servers for redundancy, etc. It makes things not straightforward, and you certainly don't want to use the default certbot which overwrites your config.
- MrStonedOne 7y ago
  I am on alexa 1m (50k even). I do not have a load balancer, I do not have multiple servers for redundancy. This isn't even a static site, most of our page views are the wiki, the server running all of this has 8 cores and 4 are constantly maxxed out by a non-website related process. Most websites now and days are over engineered.
  - uasm 7y ago
    > "I am on alexa 1m (50k even). I do not have a load balancer, I do not have multiple servers for redundancy. This isn't even a static site, most of our page views are the wiki, the server running all of this has 8 cores and 4 are constantly maxxed out by a non-website related process. Most websites now and days are over engineered." That's awesome! Mind sharing some more details? (hosting plan/CDN/etc). Or even the URL?
    - MrStonedOne 7y ago
      Rented dedicated server running a 9900k. Windows hypervisor runs vms. database vm, website vm, and 3 game server vms running on this machine. each game server vm is running 2 instances of the game server, but only 1 ever has high pop. https://tgstation13.org https://tgstation13.org Most of our traffic goes to our wiki: we are the most active open source video game on github. Most ss13 servers run their own codebase, forked from ours, but will still frequently point their players to our wiki rather then set one up on their own. A Cloudflare caching layer was added back in march when we got a 4x spike in web traffic from a youtuber talking about the game.
  - owl57 7y ago
    Checked my old site's rank. ~250000. One VPS, €4/month. Mostly static, but a decent part is served with a not so light Perl CGI script (!). I'm sure I wouldn't get away with that in top 1k websites, but 1m?
contravariant 7y ago
I'd appreciate it if the instructions explained why they need sudo, rather than explain what sudo is...
maple3142 7y ago
Maybe not everyone host website on a platform where you can easily install these things. For example, I have a simple web app hosted on Heroku free plan, and I have to use CloudFlare SSL to get it served over https on my custom domain. But it actually is half encrypted as the connection between CloudFlare and Heroku is plain http.
- ridiculous_fish 7y ago
  Right. Another example is that you cannot use https with subdomains on GitHub Pages. https://github.community/t5/GitHub-Pages/Does-GitHub-Pages-Support-HTTPS-for-www-and-subdomains/m-p/7202#M495 https://github.community/t5/GitHub-Pages/Does-GitHub-Pages-S...

Instructions are here: https://certbot.eff.org/ https://certbot.eff.org/ I don't know how it could possibly be any simpler.

by chungy 7y ago

Instructions are here: https://certbot.eff.org/ https://certbot.eff.org/ I don't know how it could possibly be any simpler.

onion-soup 7y ago

While I appreciate the efforts of certbot to make it as user-friendly as possible I still find this state of things unforgivable. I don't know where it went wrong so that today a developer must spend time learning and tweaking a low-level encryption tools. I'm just saying https will never be 100% unless it becomes a baked-in feature of any hosting.

cm2187 7y ago
Starting with baking ACMEv2 in the major webservers (apache, IIS, etc).
- deleted 7y ago
  [deleted]
- Jaruzel 7y ago
  If Microsoft baked in Auto-cert-install in to IIS that allowed you to cherry pick a provider, and/or just select their own free CA, that'd really solve the problem for Windows based web servers. In my experience CertBot/ACME type renewal doesn't work reliably for Windows/IIS.
regecks 7y ago
Certbot, and most other standalone ACME clients, are just stop-gaps. The end game is first-party support for automatic HTTPS in all web (and other) servers. It is happening (e.g. mod_md), it's just going to take time. For example, to get it packaged for all distributions. For shared hosting, if you ignore the few providers at the top who are either CAs (e.g. GoDaddy) or are in contracts with CAs (e.g. Namecheap), the overwhelming majority of them are already providing free and automatic SSL for all hosted domains.
- majewsky 7y ago
  > The end game is first-party support for automatic HTTPS in all web (and other) servers. There's still a need for certbot et al when you have multiple services (e.g. web and mail and XMPP) running on a single domain name. In fact, I actively avoid servers that insist on doing ACME themselves because it breaks my unified ACME process.
jbverschoor 7y ago
It’s for ops. Not dev
thenewnewguy 7y ago
Developers don't need to, unless they're the ones hosting your website. In which case, yes, I expect them to be able to configure web hosting software.
- hrktb 7y ago
  This is sadly not the case yet in many not so edge cases. For instance Heroku still doesn't provide straightforward support for wildcard domains under SSL: https://devcenter.heroku.com/articles/understanding-ssl-on-heroku https://devcenter.heroku.com/articles/understanding-ssl-on-h... There is myriad of other cases, basically every time you diverge a bit from the 80% path, you're in for a treat and will deal with all the intricacies of SSL management.
AnIdiotOnTheNet 7y ago
What is the value in HTTPS being 100%? That seems silly to me. Many many things do not have any need for encryption.
- tialaramex 7y ago
  Most things would benefit from encryption. Even if you don't need integrity protection, and you don't have any need of privacy, and you don't care about authenticating your peers you still want encryption because otherwise middleboxes ossify everything. If the middlebox can't see inside your flow because it's encrypted it can't object to whatever new thing it's scared of this time whether that's HD video or a new HTML tag.
  - AnIdiotOnTheNet 7y ago
    Not a significant issue in practice as far as I can tell. I deliver text over the internet, and sometimes binaries over the internet, and it happens very fast because there is no useless cruft in the process to satisfy some security twonk's paranoid delusions.
kbr2000 7y ago
A management fad called dev-ops is what went wrong, before you could count on your sysadmin to take care of that :) Apart from that, not everything always makes sense to use in production without a good level of understanding --- and might otherwise lead to, for example, a false sense of security.

elcomet 7y ago

It is simple for a one-server website. When you're on Alexa 1M, you certainly have a load balancer, multiple servers for redundancy, etc. It makes things not straightforward, and you certainly don't want to use the default certbot which overwrites your config.

MrStonedOne 7y ago
I am on alexa 1m (50k even). I do not have a load balancer, I do not have multiple servers for redundancy. This isn't even a static site, most of our page views are the wiki, the server running all of this has 8 cores and 4 are constantly maxxed out by a non-website related process. Most websites now and days are over engineered.
- uasm 7y ago
  > "I am on alexa 1m (50k even). I do not have a load balancer, I do not have multiple servers for redundancy. This isn't even a static site, most of our page views are the wiki, the server running all of this has 8 cores and 4 are constantly maxxed out by a non-website related process. Most websites now and days are over engineered." That's awesome! Mind sharing some more details? (hosting plan/CDN/etc). Or even the URL?
  - MrStonedOne 7y ago
    Rented dedicated server running a 9900k. Windows hypervisor runs vms. database vm, website vm, and 3 game server vms running on this machine. each game server vm is running 2 instances of the game server, but only 1 ever has high pop. https://tgstation13.org https://tgstation13.org Most of our traffic goes to our wiki: we are the most active open source video game on github. Most ss13 servers run their own codebase, forked from ours, but will still frequently point their players to our wiki rather then set one up on their own. A Cloudflare caching layer was added back in march when we got a 4x spike in web traffic from a youtuber talking about the game.
- owl57 7y ago
  Checked my old site's rank. ~250000. One VPS, €4/month. Mostly static, but a decent part is served with a not so light Perl CGI script (!). I'm sure I wouldn't get away with that in top 1k websites, but 1m?

contravariant 7y ago

I'd appreciate it if the instructions explained why they need sudo, rather than explain what sudo is...

maple3142 7y ago

Maybe not everyone host website on a platform where you can easily install these things. For example, I have a simple web app hosted on Heroku free plan, and I have to use CloudFlare SSL to get it served over https on my custom domain. But it actually is half encrypted as the connection between CloudFlare and Heroku is plain http.

ridiculous_fish 7y ago
Right. Another example is that you cannot use https with subdomains on GitHub Pages. https://github.community/t5/GitHub-Pages/Does-GitHub-Pages-Support-HTTPS-for-www-and-subdomains/m-p/7202#M495 https://github.community/t5/GitHub-Pages/Does-GitHub-Pages-S...