3 ms·

> I shudder to think about what will happen if they go down for whatever reason. We would quickly see article and reminder that free means you are not the clie

> I shudder to think about what will happen if they go down for whatever reason. We would quickly see article and reminder that free means you are not the client :) Just recently I had issues with Lets Encrypt bot. Apparently on new version of Centos it craps out with some incompatible python libraries. Once I fixed it it turned out I am blacklisted from requesting new certs for 7 days, per their rate limits. That made me come back to drawing board for 60-some domains I ran and just purchase the damn certs. They so cheap these days unless you ran a hobby website its just not worth the savings.

schoen 7y ago
> it turned out I am blacklisted from requesting new certs for 7 days, per their rate limits The rate limit for failed issuance is one hour, not 7 days. The 7 day rate limit applies when you successfully issue 5 identical certificates; then you have to wait 7 days more to issue a new identical certificate. https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/ It's unlikely that you would be subject to the 7 day duplicate certificate limit due to a Certbot dependency problem, because the dependency problem would have to allow Certbot to obtain the certificates correctly but fail to save them properly. (Source: I'm a Certbot developer.) I should also add that I'm really sorry that you experienced an installation problem on CentOS. Dependency and packaging problems continue to be a challenge for Certbot and our colleagues are still trying to find a more universal solution to them (probably involving snaps).
cuspycode 7y ago
I had similar problems with that bot recently (i.e. the python bot "certbot"), so I looked around and found a very nice alternative named PJAC[0]. I have now switched a bunch of my domains to use PJAC, and so far it works like a charm. Its only dependency is Java (version 8 or higher). Everything else is bundled in the downloaded artifact, just as it should be. [0] https://github.com/porunov/acme_client https://github.com/porunov/acme_client
alwillis 7y ago
I’m a fan of acme.sh [1]. It’s a battle-tested Bash script that handles many different use cases, including many DNS providers if dns-01 is how you roll. I run my own DNS server using Knot and acme.sh supports it. [1]: https://github.com/acmesh-official/acme.sh https://github.com/acmesh-official/acme.sh

schoen 7y ago

> it turned out I am blacklisted from requesting new certs for 7 days, per their rate limits The rate limit for failed issuance is one hour, not 7 days. The 7 day rate limit applies when you successfully issue 5 identical certificates; then you have to wait 7 days more to issue a new identical certificate. https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/ It's unlikely that you would be subject to the 7 day duplicate certificate limit due to a Certbot dependency problem, because the dependency problem would have to allow Certbot to obtain the certificates correctly but fail to save them properly. (Source: I'm a Certbot developer.) I should also add that I'm really sorry that you experienced an installation problem on CentOS. Dependency and packaging problems continue to be a challenge for Certbot and our colleagues are still trying to find a more universal solution to them (probably involving snaps).

cuspycode 7y ago

I had similar problems with that bot recently (i.e. the python bot "certbot"), so I looked around and found a very nice alternative named PJAC[0]. I have now switched a bunch of my domains to use PJAC, and so far it works like a charm. Its only dependency is Java (version 8 or higher). Everything else is bundled in the downloaded artifact, just as it should be. [0] https://github.com/porunov/acme_client https://github.com/porunov/acme_client

alwillis 7y ago

I’m a fan of acme.sh [1]. It’s a battle-tested Bash script that handles many different use cases, including many DNS providers if dns-01 is how you roll. I run my own DNS server using Knot and acme.sh supports it. [1]: https://github.com/acmesh-official/acme.sh https://github.com/acmesh-official/acme.sh