5 ms·

I don't believe there was a way to automate the certificate signing from StartTLS or WoSign, was there?

by zeendo 7y ago

tialaramex 7y ago
StartCom actually did build a rival service after Let's Encrypt was started named StartAPI. There were some fairly grave noob-type security bugs in that service (to be fair Let's Encrypt almost went live with a fairly grave but more subtle to understand bug, and did go live with tls-sni-01 which it turns out is unsafe if people use Apache HTTPD for bulk web hosting which er, they do). Because of the grave problems StarCom turned their API off after not very long, presumably with the intent to eventually repair it and re-launch. A surprising number of people became convinced Let's Encrypt was some sort of attack on StartCom and that the other problems with StartCom/ WoSign (eventually leading to them being distrusted) were a conspiracy to popularize Let's Encrypt.
vbezhenar 7y ago
They issued 1-year long certificate (I think that wosign even issued 3-years certificate at some point), so it was never a problem. Now with letsencrypt I always forget to update some of my certificates, because they expire so fast.
- eropple 7y ago
  That you have to remember to update your certificates is the problem here. Automation solves these problems. Don't be the computer's slave--tell it what to do.
  - vbezhenar 7y ago
    I'll spend more time trying to automate that, than renewing it for a 20 years manually.
    - stewartm 7y ago
      Obligatory: https://xkcd.com/1205/ https://xkcd.com/1205/
    - eropple 7y ago
      1) That's just plainly and self-evidently silly. `0 0 * * 0 certbot --nginx`. Season to taste. (There are more involved options out there--but you bought into them by making other choices ahead of time, and that's a learning experience for you to better understand your tradeoffs in the future.) 2) 20 years' expiration is a security risk that should not be taken. Letting you do that would be a bad idea not just for you--you can make stupid decisions on your own--but for anyone who connects to you, and you aren't entitled to do that. I don't understand why someone who is theoretically a programmer would be so odd about this.

I don't believe there was a way to automate the certificate signing from StartTLS or WoSign, was there?

by zeendo 7y ago

I don't believe there was a way to automate the certificate signing from StartTLS or WoSign, was there?

StartCom actually did build a rival service after Let's Encrypt was started named StartAPI. There were some fairly grave noob-type security bugs in that service (to be fair Let's Encrypt almost went live with a fairly grave but more subtle to understand bug, and did go live with tls-sni-01 which it turns out is unsafe if people use Apache HTTPD for bulk web hosting which er, they do). Because of the grave problems StarCom turned their API off after not very long, presumably with the intent to eventually repair it and re-launch. A surprising number of people became convinced Let's Encrypt was some sort of attack on StartCom and that the other problems with StartCom/ WoSign (eventually leading to them being distrusted) were a conspiracy to popularize Let's Encrypt.

vbezhenar 7y ago

They issued 1-year long certificate (I think that wosign even issued 3-years certificate at some point), so it was never a problem. Now with letsencrypt I always forget to update some of my certificates, because they expire so fast.

eropple 7y ago
That you have to remember to update your certificates is the problem here. Automation solves these problems. Don't be the computer's slave--tell it what to do.
- vbezhenar 7y ago
  I'll spend more time trying to automate that, than renewing it for a 20 years manually.
  - stewartm 7y ago
    Obligatory: https://xkcd.com/1205/ https://xkcd.com/1205/
  - eropple 7y ago
    1) That's just plainly and self-evidently silly. `0 0 * * 0 certbot --nginx`. Season to taste. (There are more involved options out there--but you bought into them by making other choices ahead of time, and that's a learning experience for you to better understand your tradeoffs in the future.) 2) 20 years' expiration is a security risk that should not be taken. Letting you do that would be a bad idea not just for you--you can make stupid decisions on your own--but for anyone who connects to you, and you aren't entitled to do that. I don't understand why someone who is theoretically a programmer would be so odd about this.