6 ms·
You should support ACME.
by couchand 7y ago
You should support ACME.
- johannes1234321 7y agoDoesn't help on the intranet that easily, when the application runs on a domain not on public DNS. Also ACME can be problematic from policy POV.
- couchand 7y agoMy working theory is that the Venn diagram of organizations self-hosting software on an intranet with private DNS and organizations that don't have an internal CA is almost entirely disjoint. Are the policy concerns you raise related to the above, or something else?
- de_watcher 7y agoYour diagram is wrong tho.
- recursive 7y agoSome of our customers have no trouble with certificates. The others have never heard of ACME.
- couchand 7y agoBut they shouldn't have to have heard of ACME to use it. If they're hosting your software on a publicly-accessible server, the UX should be roughly: - user checks box that says they want certs issued automatically. - your software handles the rest. Of course there are plenty of details for the engineers to work out, but the end user shouldn't need to know any of them.
- recursive 7y agoThe ones that are self-hosting are more-or-less doing it specifically so that they can use non-publicly-accessible servers. So I guess that won't work. I was thinking that you were imagining that they would need to set up some kind of internal ACME infrastructure or something. Now I see you were just imagining certbot. Maybe half the domains I've seen used aren't actually publicly resolvable. Once I saw one that was, but was actually owned by someone else. Anyway, there is no easy way out.