6 ms·

ACME-only isn't the problem, it's a Let's Encrypt mono-culture I'm concerned about. We could do with another LE-style service (or two) operated independently (

by M2Ys4U 7y ago

ACME-only isn't the problem, it's a Let's Encrypt mono-culture I'm concerned about. We could do with another LE-style service (or two) operated independently (both organisationally and geopolitically).

wbond 7y ago
My point there was more about automation in the cert space could lead to traditional CAs leaving the space, in which case small operators like myself (handful of minor servers) would be forced down the automation route, which isn't necessarily a net positive.
- wbl 7y ago
  Absence of automation is why the CA death penalty is applied so late due to the consequent disruption.
ff317 7y ago
Yeah I'd love to see one or more additional free ACME issuers that are largely functionally-equivalent to LE, but in a different jurisdiction and under different management, with separate infrastructure, etc. One of the less-obvious reasons: for "serious" usage where you're also stapling OCSP responses, there's a dependency on the cert vendor's OCSP service. You can cache the OCSP outputs to get through short windows of unavailability, but if the vendor's OCSP goes offline for days or suffers some serious incident, it pays to have multiple vendors on-hand. There was such an incident with GlobalSign back in October 2016 (who's otherwise a pretty decent vendor!), so it is a legitimate concern. For "serious" use-cases, you basically need redundant live certs from redundant vendors, and not having a second LE-like option means one of those is still a legacy CA for now...
- sigio 7y ago
  There's buypass.no / buypass.com ... they are a norwegian CA that also implements ACME. I have only used them for some testing certificates so far, that have not been deployed in the wild, but their server works, the certs are valid in all browsers, and they do upto 6 month valid certs iirc. link: https://community.buypass.com/ https://community.buypass.com/
  - folmar 7y ago
    I'm using it in production with no trouble at all - I have one place where it's only possible to add SSL certs through a GUI so longer validity is a dealbreaker.
Avamander 7y ago
Blame other CAs for resting on their laurels and allowing LE to steal their marketshare.
- M2Ys4U 7y ago
  Oh I'm not shedding any tears for legacy-style CAs. But just because the previous situation was bad doesn't mean that a LE monoculture won't also be bad (for varying definitions of "bad").

by M2Ys4U 7y ago

wbond 7y ago

My point there was more about automation in the cert space could lead to traditional CAs leaving the space, in which case small operators like myself (handful of minor servers) would be forced down the automation route, which isn't necessarily a net positive.

wbl 7y ago
Absence of automation is why the CA death penalty is applied so late due to the consequent disruption.

ff317 7y ago

Yeah I'd love to see one or more additional free ACME issuers that are largely functionally-equivalent to LE, but in a different jurisdiction and under different management, with separate infrastructure, etc. One of the less-obvious reasons: for "serious" usage where you're also stapling OCSP responses, there's a dependency on the cert vendor's OCSP service. You can cache the OCSP outputs to get through short windows of unavailability, but if the vendor's OCSP goes offline for days or suffers some serious incident, it pays to have multiple vendors on-hand. There was such an incident with GlobalSign back in October 2016 (who's otherwise a pretty decent vendor!), so it is a legitimate concern. For "serious" use-cases, you basically need redundant live certs from redundant vendors, and not having a second LE-like option means one of those is still a legacy CA for now...

sigio 7y ago
There's buypass.no / buypass.com ... they are a norwegian CA that also implements ACME. I have only used them for some testing certificates so far, that have not been deployed in the wild, but their server works, the certs are valid in all browsers, and they do upto 6 month valid certs iirc. link: https://community.buypass.com/ https://community.buypass.com/
- folmar 7y ago
  I'm using it in production with no trouble at all - I have one place where it's only possible to add SSL certs through a GUI so longer validity is a dealbreaker.

Avamander 7y ago

Blame other CAs for resting on their laurels and allowing LE to steal their marketshare.

M2Ys4U 7y ago
Oh I'm not shedding any tears for legacy-style CAs. But just because the previous situation was bad doesn't mean that a LE monoculture won't also be bad (for varying definitions of "bad").