5 ms·

Certbot and LetsEncrypt make this a trivial process these days. Takes 15 minutes to set up and is free. Why not use it?

by jpxw 7y ago

deleted 7y ago
[deleted]
arlk 7y ago
or Cloudflare. Just a couple origin hits and your site is served via CDN for free, fast and secure.
- tasogare 7y ago
  Definitively no. I set up my own personal page on a VPS precisely to avoid LinkedIn, Google Scholar, Research Gate or any third party service being in control of my public face. Using another service would defeat that purpose.
  - a3n 7y ago
    Is github on your list?
  - pmontra 7y ago
    You are probably using a VPS running on someone else server, through many networks. (So do I.) Any of those can MITM your traffic. Maybe you're also using apt/yum to keep the VPS up-to-date. Is adding Letsencrypt to the list such a burden? Or maybe you're only against Cloudflare. I go with Letsencrypt.
- tristador 7y ago
  How do you secure the link between Cloudflare and your HTTP only site?
  - rahuldottech 7y ago
    It's complicated, but basically... You don't. It's much better to just set up Let's Encrypt. Takes <15 minutes.
  - michaelbuckbee 7y ago
    This is very hosting service-specific - some hosts will expose your server via a generated and wildcard cert encrypted connection (ex: Heroku and their appname.herokuapp.com). CF also allows for self-signed certs: https://blog.cloudflare.com/origin-server-connection-security-with-universal-ssl/ https://blog.cloudflare.com/origin-server-connection-securit... - which are (to me) more complicated than standard certs. The real game changer in all of this is LetsEncrypt which has become the defacto option for services with huge amounts of custom domains (Shopify, Hubspot, Wordpress) etc.
- rahuldottech 7y ago
  This is bad advice. See this comment: https://news.ycombinator.com/item?id=22146854 https://news.ycombinator.com/item?id=22146854
noizejoy 7y ago
> Certbot and LetsEncrypt make this a trivial process these days. Not on all shared hosting plans. And migrating from a shared hosting plan can be quite a lot of work, depending on the website. Also: Getting a LetsEncrypt wildcard cert for Apache on a CentOS 8 VPS is non trivial (for individuals not already familiar with docker) [1] [1] https://certbot.eff.org/lets-encrypt/centosrhel8-apache https://certbot.eff.org/lets-encrypt/centosrhel8-apache
- pmlnr 7y ago
  > Not on all shared hosting plans Use the nginx/apache plugin, or the webroot option. Yes, it won't do *, but on shared hosting, that might even be better.
  - tialaramex 7y ago
    If you have shared hosting your install step is at the hosting outfit's discretion. If they intentionally don't support Let's Encrypt to drive sales to a CA then there's no reason to let you do it yourself. This was more common when Let's Encrypt was new but still happens now.
PretzelFisch 7y ago
I was redeploying an iis hosted domain with letsencrypt. Trivial is not a word I would use in the description. In addition the tooling wants to much auth on my server and dns hosting accounts. Is it better and cheaper then 10 years but far from simple/trivial.
- tialaramex 7y ago
  Part of the rationale of ACME (the protocol which makes Let's Encrypt work, and which is standardised in RFC 8555) is that vendors should bake the support into their TLS-capable products like IIS. It seems crazy to me that Microsoft shops are annoyed that the Windows tooling for Let's Encrypt isn't great yet didn't direct that straight at their vendor. What's the point of having that relationship if they don't do what you need? Are you paying them because you hate money? Microsoft definitely could, if the feedback from customers was there, have shipped an ACME client for IIS in newer IIS releases/ updates. But the feedback from customers is seemingly "More beatings please, and have you thought of increasing prices?"
  - PretzelFisch 7y ago
    I understand what your saying but, I don't think I can just make this work out of the box with a Tom cat install? Don't I still need another Daemon/batch process? My issues are much less IIS cert update and center around how I need to prove site/domain ownership. Especially for a wild card. To me the documentation looks the same( windows or linux) a periodic update to my dns txt record to show I control this/these sites. Which means my server has to have write access to my dns?
    - tialaramex 7y ago
      IF you want a wildcard then yes Let's Encrypt only offers that for DNS proof of control. You can do two tricks here which let you greatly reduce the scope of the power granted to a machine getting the certificate and then avoid that machine having to be the machine which wants the certificate. 1. Use CNAME to make different DNS server hierarchy own the ACME proof of control. A CNAME DNS record can be permanently added to your real site, telling Let's Encrypt that it should ask DNS for a different name instead, and only that name needs to be writeable by the periodic renewal process. You can use this to pass DNS challenges for a domain where actual DNS changes take six weeks and a dozen people's signatures, because you only need one change once, not once per renewal. You should find documentation explaining this, or you can ask Let's Encrypt's community site to help if you explain your specific situation. 2. CSR re-use. Certificate Signing Requests don't have timestamps inside them. By default Let's Encrypt's popular Certbot client mints brand new key pairs for every renewal and so it needs fresh CSRs, but you needn't do that. Mint keys once when a server is created, produce a CSR for the certificate you'll want, and then re-use that CSR in a machine which just does the renewal periodically, the actual servers can fetch their renewed certificate from that machine or wherever, the certificate is public so it doesn't matter and the keys haven't changed they just need the renewed certificate for the same keys.

Certbot and LetsEncrypt make this a trivial process these days. Takes 15 minutes to set up and is free. Why not use it?

by jpxw 7y ago

Certbot and LetsEncrypt make this a trivial process these days. Takes 15 minutes to set up and is free. Why not use it?

deleted 7y ago

[deleted]

arlk 7y ago

or Cloudflare. Just a couple origin hits and your site is served via CDN for free, fast and secure.

tasogare 7y ago
Definitively no. I set up my own personal page on a VPS precisely to avoid LinkedIn, Google Scholar, Research Gate or any third party service being in control of my public face. Using another service would defeat that purpose.
- a3n 7y ago
  Is github on your list?
- pmontra 7y ago
  You are probably using a VPS running on someone else server, through many networks. (So do I.) Any of those can MITM your traffic. Maybe you're also using apt/yum to keep the VPS up-to-date. Is adding Letsencrypt to the list such a burden? Or maybe you're only against Cloudflare. I go with Letsencrypt.
tristador 7y ago
How do you secure the link between Cloudflare and your HTTP only site?
- rahuldottech 7y ago
  It's complicated, but basically... You don't. It's much better to just set up Let's Encrypt. Takes <15 minutes.
- michaelbuckbee 7y ago
  This is very hosting service-specific - some hosts will expose your server via a generated and wildcard cert encrypted connection (ex: Heroku and their appname.herokuapp.com). CF also allows for self-signed certs: https://blog.cloudflare.com/origin-server-connection-security-with-universal-ssl/ https://blog.cloudflare.com/origin-server-connection-securit... - which are (to me) more complicated than standard certs. The real game changer in all of this is LetsEncrypt which has become the defacto option for services with huge amounts of custom domains (Shopify, Hubspot, Wordpress) etc.
rahuldottech 7y ago
This is bad advice. See this comment: https://news.ycombinator.com/item?id=22146854 https://news.ycombinator.com/item?id=22146854

noizejoy 7y ago

> Certbot and LetsEncrypt make this a trivial process these days. Not on all shared hosting plans. And migrating from a shared hosting plan can be quite a lot of work, depending on the website. Also: Getting a LetsEncrypt wildcard cert for Apache on a CentOS 8 VPS is non trivial (for individuals not already familiar with docker) [1] [1] https://certbot.eff.org/lets-encrypt/centosrhel8-apache https://certbot.eff.org/lets-encrypt/centosrhel8-apache

pmlnr 7y ago
> Not on all shared hosting plans Use the nginx/apache plugin, or the webroot option. Yes, it won't do *, but on shared hosting, that might even be better.
- tialaramex 7y ago
  If you have shared hosting your install step is at the hosting outfit's discretion. If they intentionally don't support Let's Encrypt to drive sales to a CA then there's no reason to let you do it yourself. This was more common when Let's Encrypt was new but still happens now.

PretzelFisch 7y ago

I was redeploying an iis hosted domain with letsencrypt. Trivial is not a word I would use in the description. In addition the tooling wants to much auth on my server and dns hosting accounts. Is it better and cheaper then 10 years but far from simple/trivial.

tialaramex 7y ago
Part of the rationale of ACME (the protocol which makes Let's Encrypt work, and which is standardised in RFC 8555) is that vendors should bake the support into their TLS-capable products like IIS. It seems crazy to me that Microsoft shops are annoyed that the Windows tooling for Let's Encrypt isn't great yet didn't direct that straight at their vendor. What's the point of having that relationship if they don't do what you need? Are you paying them because you hate money? Microsoft definitely could, if the feedback from customers was there, have shipped an ACME client for IIS in newer IIS releases/ updates. But the feedback from customers is seemingly "More beatings please, and have you thought of increasing prices?"
- PretzelFisch 7y ago
  I understand what your saying but, I don't think I can just make this work out of the box with a Tom cat install? Don't I still need another Daemon/batch process? My issues are much less IIS cert update and center around how I need to prove site/domain ownership. Especially for a wild card. To me the documentation looks the same( windows or linux) a periodic update to my dns txt record to show I control this/these sites. Which means my server has to have write access to my dns?
  - tialaramex 7y ago
    IF you want a wildcard then yes Let's Encrypt only offers that for DNS proof of control. You can do two tricks here which let you greatly reduce the scope of the power granted to a machine getting the certificate and then avoid that machine having to be the machine which wants the certificate. 1. Use CNAME to make different DNS server hierarchy own the ACME proof of control. A CNAME DNS record can be permanently added to your real site, telling Let's Encrypt that it should ask DNS for a different name instead, and only that name needs to be writeable by the periodic renewal process. You can use this to pass DNS challenges for a domain where actual DNS changes take six weeks and a dozen people's signatures, because you only need one change once, not once per renewal. You should find documentation explaining this, or you can ask Let's Encrypt's community site to help if you explain your specific situation. 2. CSR re-use. Certificate Signing Requests don't have timestamps inside them. By default Let's Encrypt's popular Certbot client mints brand new key pairs for every renewal and so it needs fresh CSRs, but you needn't do that. Mint keys once when a server is created, produce a CSR for the certificate you'll want, and then re-use that CSR in a machine which just does the renewal periodically, the actual servers can fetch their renewed certificate from that machine or wherever, the certificate is public so it doesn't matter and the keys haven't changed they just need the renewed certificate for the same keys.