4 ms·

Yeah it is more work. If you're a sysadmin, that is your job and it's why you get paid. You're welcome to choose another job if it's too much work for you.

at_a_remove 6y ago
Yes, it is more work. And doing it doing it once every month instead of once a year is yet more work. But is it valuable work? Does that work accomplish anything? Or is that effort wasted when I could have been doing other things? I was not a sysadmin -- I kept trying to avoid that, but got sucked in, as a programmer (my title), with the reasoning I have been doing "web stuff" for a long time, as well as the sysadmin duties that were required for setting up websites "back in the day." I could have been programming and solving real problems on a more permanent basis, but here I am, carrying water with a hole in the bottom of the bucket. Once the DevOps wand got waved, I got out. If people are truly concerned about security, even the much-disliked sysadmin duties foisted upon me could have had the time more wisely spent then flipping certs around.
- kerkeslager 6y ago
  1. I am extremely skeptical of your claim that cert renewals couldn't be automated. 2. Nobody here is saying that you need to renew your certs every month. Just because some completely different person asked for something that didn't provide any value, doesn't prove that what anyone here is saying is incorrect.
  - at_a_remove 6y ago
    Okay, be skeptical. I didn't want to void our support contract over finding out. Would you come to my rescue if I did? First the certs need to be renewed every three years. And some browsers want to raise warnings if they're past a year old. And Let's Encrypt is down to three months. Just waiting for the next click of the ratchet.
    - kerkeslager 6y ago
      > Okay, be skeptical. I didn't want to void our support contract over finding out. Really? Your support contract would be voided if you automated certificate renewal? If what you're saying is true, the problem isn't with short renewal times, it's with your absurd support contract. Automatic renewal is the industry standard at this point. If anything, your support contract should be voided if an error occurs because you failed to automate this. I suppose it's possible that your support contract is that absurd, but given it sounds like you didn't even check, it seems a lot more likely that you don't know how to automate it and refuse to learn. You don't get to critique Let's Encrypt, a system built with automatic renewal as a fundamental component, if you refuse to use the very simple to use tools[1] they provide for automatic renewal. Maybe it's the support contract's fault, maybe it's your fault, but it's definitely not LetsEncrypt's fault that you're stuck in 2010 through incompetence or bad contract negotiation. You could spend literally 5 minutes per server and never have this problem again. [1] https://certbot.eff.org/ https://certbot.eff.org/
      - at_a_remove 6y ago
        All of the cert stuff was hidden behind a very complex series of menuing and more. I keep saying it in different ways: This wasn't just an Apache server. Could I have pried behind the curtain? Yes? Would it have worked? Most likey! Were there lots of big warnings about not screwing with various sections of the configuration even if I could get to them? Also yes. They really didn't want you to interact with the system beyond a few set points and that was clarified to me in a call with tech support. I didn't like it, but that's what I had to work with. This just wasn't one a thousand bog-standard Apache rollouts that you could chuck certs into. Want your CSR? Go through their menu system to generate it. Want to install it? Upload it to this specific directory, then hit the menus again. CertBot is fine for what it does. Great. But it wasn't appropriate for what we had.
        kerkeslager 6y ago
        Sounds like a valid complaint about your contract, not a valid complaint about systems which you aren't using as intended.

at_a_remove 6y ago

Yes, it is more work. And doing it doing it once every month instead of once a year is yet more work. But is it valuable work? Does that work accomplish anything? Or is that effort wasted when I could have been doing other things? I was not a sysadmin -- I kept trying to avoid that, but got sucked in, as a programmer (my title), with the reasoning I have been doing "web stuff" for a long time, as well as the sysadmin duties that were required for setting up websites "back in the day." I could have been programming and solving real problems on a more permanent basis, but here I am, carrying water with a hole in the bottom of the bucket. Once the DevOps wand got waved, I got out. If people are truly concerned about security, even the much-disliked sysadmin duties foisted upon me could have had the time more wisely spent then flipping certs around.

kerkeslager 6y ago
1. I am extremely skeptical of your claim that cert renewals couldn't be automated. 2. Nobody here is saying that you need to renew your certs every month. Just because some completely different person asked for something that didn't provide any value, doesn't prove that what anyone here is saying is incorrect.
- at_a_remove 6y ago
  Okay, be skeptical. I didn't want to void our support contract over finding out. Would you come to my rescue if I did? First the certs need to be renewed every three years. And some browsers want to raise warnings if they're past a year old. And Let's Encrypt is down to three months. Just waiting for the next click of the ratchet.
  - kerkeslager 6y ago
    > Okay, be skeptical. I didn't want to void our support contract over finding out. Really? Your support contract would be voided if you automated certificate renewal? If what you're saying is true, the problem isn't with short renewal times, it's with your absurd support contract. Automatic renewal is the industry standard at this point. If anything, your support contract should be voided if an error occurs because you failed to automate this. I suppose it's possible that your support contract is that absurd, but given it sounds like you didn't even check, it seems a lot more likely that you don't know how to automate it and refuse to learn. You don't get to critique Let's Encrypt, a system built with automatic renewal as a fundamental component, if you refuse to use the very simple to use tools[1] they provide for automatic renewal. Maybe it's the support contract's fault, maybe it's your fault, but it's definitely not LetsEncrypt's fault that you're stuck in 2010 through incompetence or bad contract negotiation. You could spend literally 5 minutes per server and never have this problem again. [1] https://certbot.eff.org/ https://certbot.eff.org/
    - at_a_remove 6y ago
      All of the cert stuff was hidden behind a very complex series of menuing and more. I keep saying it in different ways: This wasn't just an Apache server. Could I have pried behind the curtain? Yes? Would it have worked? Most likey! Were there lots of big warnings about not screwing with various sections of the configuration even if I could get to them? Also yes. They really didn't want you to interact with the system beyond a few set points and that was clarified to me in a call with tech support. I didn't like it, but that's what I had to work with. This just wasn't one a thousand bog-standard Apache rollouts that you could chuck certs into. Want your CSR? Go through their menu system to generate it. Want to install it? Upload it to this specific directory, then hit the menus again. CertBot is fine for what it does. Great. But it wasn't appropriate for what we had.
      - kerkeslager 6y ago
        Sounds like a valid complaint about your contract, not a valid complaint about systems which you aren't using as intended.