8 ms·

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible an

This may be good for security, but it is extra burden for small web developers and individuals. Big players will have cert renewals automated. It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. Without automation, you've got an annual chore to do or your site goes offline. I think some hosts are already starting to offer free and easy SSL certs to their small customers, but I do expect automated SSL management to be generally available for the masses before this takes effect.

wolf550e 6y ago
Can you describe the kind of person who hosts their own website but cannot easily set up Let's Encrypt automatic renewal?
- raverbashing 6y ago
  Shared hosting Unless they set up LtE for their customers (And as much as I like LtE I think it's complicate to depend in one issuer only)
  - DiederikvandenB 6y ago
    Semaphor asks "can you describe the kind of person". Since when is "shared hosting" a person? People who know how to set up a website on a shared hosting platform probably also know how to renew a LE certificate, I think.
- maxmalysh 6y ago
  http://www.paulgraham.com/ http://www.paulgraham.com/
  - brian-bk 6y ago
    There's no cert because there's no need for one in the first place. Mentioning that is pretty silly - it's obvious that there's nothing wrong with a static site with now cert, and no one is arguing against that.
    - maxmalysh 6y ago
      > there's nothing wrong with a static site with no cert Not really. Google says "switch to HTTPS or lose ranking": https://webmasters.googleblog.com/2014/08/https-as-ranking-signal.html https://webmasters.googleblog.com/2014/08/https-as-ranking-s...
      - brian-bk 6y ago
        Good to note. But I think you're distracting from the article's talking point. I disagree with "switch to HTTPS or lose ranking", but that's an HTTP vs. HTTPS issue with Google's search ranking, not about Chromium or Mozilla. This article is about Chromium & Mozilla making stricter rules for HTTPS certificates. That's not a bad thing, to hold HTTPS sites to a better standard.
    - riffic 6y ago
      > no need for one in the first place ... it's obvious that there's nothing wrong with a static site with no cert Oh yes, there is. https://doesmysiteneedhttps.com https://doesmysiteneedhttps.com > YES > Your site needs HTTPS.
- cm2187 6y ago
  Devices with web based interface (KVM over IP, IPMI, etc).
  - Spivak 6y ago
    iDRAC has a CLI tool that can be instrumented to install new certs regularly. I’m sure other vendors do as well.
- waheoo 6y ago
  Letsencrypt is broken or an incredible pain in so many different setups its not even funny.
  - Spivak 6y ago
    What are setups where it’s broken? Sincerely. If you can’t accept inbound http traffic then you use DNS verification and if you never contact the internet then no public cert could work for you.
- Simon_says 6y ago
  Me. I use shared hosting on a server that runs a reverse nginx proxy to my nginx server. I don't have root on the server. I have a LE cert that I need to manually fiddle with DNS settings every 3 months to get. If you know how to automate it I'd love to hear about it.
  - wolf550e 6y ago
    Why doesn't their nginx proxy /.well-known/ requests for your domain to your nginx? Then you could just use `certbot certonly --webroot --webroot-path /path/to/webroot/for/your/domain -d your.domain.name -d www.your.domain.name` once and put `certbot renew` and nginx reload in crontab weekly, and you're good to go. If you can't use HTTP-01 and must use DNS-01 challenge, I would check whether the software that runs your host's DNS management panel has an API in addition to manual mode. If not, I would check for ability to automate HTTP requests to that tool (parse the HTML, submit the forms, basically). My hope would be that the tool is popular and someone already did the work and code exists to operate it as if it had an API. If you can do that, you can write (or find one already written) a certbot plugin that performs the DNS challenge using your credentials to the host provided DNS settings. certbot has number of plugins for the big hosting providers: https://github.com/certbot/certbot https://github.com/certbot/certbot certbot is the most popular Let's Encrypt client, but it's not the only one. Maybe another client has support for your situation. I would maybe ask the support of your hosting provider, maybe they know something.
- superkuh 6y ago
  That's me! I'm technical enough to self-sign for ssl for my sites (it and tor are what I do instead) but I run on lots of old hardware and old (>5 years) OSes. The tools for constantly re-updating letsencrypt simply don't work and all the containerizations didn't exist yet. I've tried nearly a dozen LetsEncrypt updates solutions, compiled from source, from debs, "standalone" only bash solutions, etc, there's always a catch that prevents it from working.
  - brian-bk 6y ago
    Are those >5 year OSes receiving security patches?
    - imtringued 6y ago
      They probably receive more security patches than Centos 8 and by that I mean Centos 8 is lagging behind.
- tonetheman 6y ago
  Lots of people. Such arrogance from those who post on hackernews.
- rkagerer 6y ago
  The whole "Let's Encrypt should solve all your problems" attitude is arrogant and short-sighted. 1) In my experience the user experience even for technical admins is still flakey on at least some popular platforms. In other words, it's not as incredible as you think. 2) It's not available to a host that doesn't connect to the internet but does occasionally get connected to by a local browser (eg. IoT firewalled inside my LAN is one obvious such case; I'm sure there are others). And most importantly: 3) You'd have to be insane or naive to accept an architecture that leaves you dependant on a single vendor (especially if you need that vendor more than they need you!).
  - yjftsjthsd-h 6y ago
    How fortunate, then, that LE isn't the only vendor. Not even the only ACME vendor, nor the only free vendor (https://zerossl.com/features/acme/ https://zerossl.com/features/acme/).
  - Spivak 6y ago
    If your device never connects to the internet then how would any public cert work? It would expire like any other?
Semaphor 6y ago
> that still takes some time to set up, manage and maintain over time. I’d say it takes less time than going through a single paid certificate store… Assuming you already have a tool. If you don’t, then maybe it’s the same or 5 minutes more.
floatingatoll 6y ago
One reason for these proposals was to put pressure on the SSL certificate ecosystem to provide (CAs) and adopt (hosting) automated SSL renewal practices. Businesses have had three years since Let's Encrypt first went live to adopt such practices, but many chose not to — not just hosting providers, but e.g. bigcorp load balancers too.
- cutler 6y ago
  Guess what - not all websites are businesses. In fact not all websites are dynamically-generated so why the fsck do we all have to put up with this madness? Make HTTPS/SSL necessary for transactional sites but for simple static sites give me a break.
  - riffic 6y ago
    did you know there are ISPs out there that inject garbage code into the html of unprotected sites? get out of here with this HTTPS is unnecessary tedium.
    - gsich 6y ago
      Better not do business with shady companies then.
      - riffic 6y ago
        or you could follow established best practices and secure your site with TLS.
        gsich 6y ago
        Both. I am not responsible if you chose a shitty ISP.
        Spivak 6y ago
        But this makes no sense because the user has basically zero control of how their traffic is routed to/from you. If we could trust the entire network we wouldn’t need TLS for any site.
staticassertion 6y ago
Responsibilities have changed a bit. If you're going to host a website you are going to have to put a modicum of effort into ensuring that you are not harming others by doing so.
- superkuh 6y ago
  >are not harming others How is HTTP harmful when you visit my website about amateur radio? An expired cert is no more harmful than bare http in this non-commercial non-institional personal context. It's the one being discussed in this sub-thread in case you missed it and assumed the normal HN business context. The burden is real and completely unecessary for personal websites. This makes the web more commercial by imposing commercial requirements on everyone. It's what killed off self-signing as a speed bump against massive surveillance and centralized everyone into the benign dictactorship of letsencrypt. But centralization will lead to problems when money is involved. Just look at dot org. The real harm comes from this fetishism of commercial/institutional security models.
  - staticassertion 6y ago
    > It's the one being discussed in this sub-thread in case you missed it and assumed the normal HN business context. I did miss that but I did not assume a business context. > The burden is real and completely unecessary for personal websites. Users who visit your website are still at risk of having their connection hijacked - they could be phished, exploited, etc. This is maybe not something you consider important, it is certainly a sort of "boil the ocean" approach, but given the efforts put in up until this point I think it's already the case that most users are probably not visiting HTTP sites on the average day. Continuing that effort seems reasonable. > This makes the web more commercial by imposing commercial requirements on everyone. I'm not sure what you mean.
  - cutler 6y ago
    Agreed. I'm sick to the back teeth of fscking with HTTPS/SSL on all the client static sites I manage. Certbot-apache was so flaky I had to switch every client to Nginx so that I could use certbot-nginx. The web has become a no-go zone for do-it-yourselfers. If I didn't setup my clients in VPSs I don't know how we would manage all the mailserver blacklisting and endless HTTPS/SSL requirements.
polishdude20 6y ago
Check out Caddy Server. It was only a few days ago when I was still managing my own certs and renewing them with a Cron job. Caddy now acts as my proxy for my various web domains and it handles certs automatically. Like literally you fill out a few lines in the config called a Caddy file and you do Caddy run and it gets the certs itself. And as long as it's running, it renews them automatically.
- dingaling 6y ago
  Giving an Internet-connected program autonomous write-access to system-critical filesystems is not considered good practice in production environments. Much better to have a separate central cert management system that handles renewals and pushes the certs outwards to the DMZ systems.
  - AlfeG 6y ago
    This is true for enterprise, but for small business Caddy or Traefik is totally fine.
    - mholt 6y ago
      Caddy is good for enterprise use too because of its configurable, pluggable storage backends (doesn't have to be a file system). You can achieve the permission segmenting your company requires. You can also use it as a certificate manager independently of a web server if you want.
blibble 6y ago
it takes absolutely no time at all to set up for an individual on their VPS, compared to the faff of going through the openssl csr process + buying from a CA
- cutler 6y ago
  "On their VPS". What are you smoking?
luhn 6y ago
There are lots of good options for low-maintenance SSL certificates, from self-hosted (Let's Encrypt) to CDNs (CloudFlare) to hosting platforms (Netlify). Even so, this doesn't actually change much. I've never bought a certificate valid for more than a year. I'm not aware of any major player that sells certificates valid for more than a year. So this rule has existed for a long time in practice, but is only now being codified.
certera 6y ago
Check out Certera https://docs.certera.io https://docs.certera.io It's PKI for Let's Encrypt certificates. Helps you issue, renew, revoke certs from a central place. Also get alerts so you know when things have changed, expired, failed to renew. While a lot of places give you certs built in, there's a whole world of places you still need certs. Like FTP, mail, behind load balancers, disparate environments and systems, etc. In the future, I'm planning on creating a way to automate the certificate exchange process. This should help with using and exchanging certs used in client authentication and things like SAML SSO. If expiration get down to a month or less, I see a need for a system to help do all of these things and more.
- GordonS 6y ago
  This looks interesting as a log of Let's Encrypt certificate operations, but is it more than that, and why would I want to use it?
  - certera 6y ago
    To centrally manage all of your LE certificates, keys, alerting, etc. You can also more easily use LE certs in a wider array of scenarios too. Check out the docs to learn more.
    - GordonS 6y ago
      I did have a look at the docs, but they more explained the how, rather than the why - I missed some kind of intro/overview explaining the value proposition. I'm still a bit fuzzy on this - why would I want alerting, for example? Automation is a big part of LE, and my certs are configured to auto-renew. If that was to fail for some reason, then LE will send me an email - is it this part where this tool comes in, providing improved alerts where automation has failed?
      - certera 6y ago
        That's great feedback. I'll update the docs to better explain the why. To elaborate on the why for alerting, there are many situations that I've seen where things change and subsequently fail silently. Perhaps some dependencies, or maybe configuration changes, caused things to break. Also, alerting doesn't only have to be for your certificates. You can point to any endpoint to monitor as well. There are three aspects of alerting: changes to the cert (perhaps you care about a 3rd party certificate and its underlying key changing), failure to renew, and expirations. Each comes with its own benefits and use cases. To expand on the why a bit further for the project as a whole, it's really as a way to help consolidate and centralize things. I've seen many disparate ways of using Let's Encrypt. From various clients to some hacks to better support more complicated scenarios. By separating obtaining the certificate from applying, it helps facilitate many things, like using LE certs behind load balancers & proxies, non-standard ports, things that don't speak HTTP, etc. If certificate expiration continues to decrease in time, we'll need some capabilities to exchange certificates in an automated fashion as well. I'd also like to incorporate Certificate Transparency logs so you can be sure no one has issued certs for your domain(s). There are many cool and interesting scenarios but mostly the challenges come when managing things at scale. So, it's not really all that useful if you're only managing one or two certs.
deleted 6y ago
[deleted]
lvh 6y ago
I genuinely believe that in 2020 the myriad of ways of getting automated TLS is easier than logging into a website and uploading a CSR and then placing that certificate somewhere.
tinus_hn 6y ago
It is not much harder to do this every year as opposed to doing this every few years. It’s just an incentive to streamline the process.
brian-bk 6y ago
> It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. If you want to run a webserver but are unable to set up a cronjob that does certbot renew you don't deserve external users. Full stop. If it's just you and you don't care about your own security, then do whatever you want in your own browser.
- jjcon 6y ago
  > you don't deserve external users. Full stop. It’s shit attitudes like this that killed the old internet we all loved
  - brian-bk 6y ago
    It's not wrong to build whatever you want for yourself. But if you have external users on your site sending data to your site, you have a responsibility to not treat your users' data as meaningless.
  - xtracto 6y ago
    Don't feed the 5 hour old troll account.
- imtringued 6y ago
  I have tried to look at the documentation for certbot and the amount effort they put into optimizing the fastpath makes it incredibly difficult to do things manually. The documentation is absolutely awful. Certbot uses .pem files which are practically useless to any JVM based application. So now you got to add your --deploy-hook and add a custom script to convert everything. Don't use any of the blessed DNS providers? Again write your own authentication and cleanup hooks. Suddenly your simple certbot setup involves 3 different scripts that have to be tailored to your specific situation. Sure there are nice blog posts that go through the entire thing but the official documentation basically pretends that your use case doesn't even exist because everyone is running Apache and Nginx, right guys?
user5994461 6y ago
You've got it backward. It is a boon for small players and troubles for large companies. Small players can easily get certificates manually or automate. The platforms/tools they use often give certificates out of the box (cloudflare, heroku, wordpress, etc...). Large players can't manage certificates. Developers/sysadmins can't use let's encrypt because it's prohibited by higher up and blocked. Even if they could use it, it's not supported by their older tools and devices. The last large company I worked for had no automation around certificates and the department that handled certificate requests was sabotaging attempts to automate, possibly out of fear of losing their jobs.

wolf550e 6y ago

Can you describe the kind of person who hosts their own website but cannot easily set up Let's Encrypt automatic renewal?

raverbashing 6y ago
Shared hosting Unless they set up LtE for their customers (And as much as I like LtE I think it's complicate to depend in one issuer only)
- DiederikvandenB 6y ago
  Semaphor asks "can you describe the kind of person". Since when is "shared hosting" a person? People who know how to set up a website on a shared hosting platform probably also know how to renew a LE certificate, I think.
maxmalysh 6y ago
http://www.paulgraham.com/ http://www.paulgraham.com/
- brian-bk 6y ago
  There's no cert because there's no need for one in the first place. Mentioning that is pretty silly - it's obvious that there's nothing wrong with a static site with now cert, and no one is arguing against that.
  - maxmalysh 6y ago
    > there's nothing wrong with a static site with no cert Not really. Google says "switch to HTTPS or lose ranking": https://webmasters.googleblog.com/2014/08/https-as-ranking-signal.html https://webmasters.googleblog.com/2014/08/https-as-ranking-s...
    - brian-bk 6y ago
      Good to note. But I think you're distracting from the article's talking point. I disagree with "switch to HTTPS or lose ranking", but that's an HTTP vs. HTTPS issue with Google's search ranking, not about Chromium or Mozilla. This article is about Chromium & Mozilla making stricter rules for HTTPS certificates. That's not a bad thing, to hold HTTPS sites to a better standard.
  - riffic 6y ago
    > no need for one in the first place ... it's obvious that there's nothing wrong with a static site with no cert Oh yes, there is. https://doesmysiteneedhttps.com https://doesmysiteneedhttps.com > YES > Your site needs HTTPS.
cm2187 6y ago
Devices with web based interface (KVM over IP, IPMI, etc).
- Spivak 6y ago
  iDRAC has a CLI tool that can be instrumented to install new certs regularly. I’m sure other vendors do as well.
waheoo 6y ago
Letsencrypt is broken or an incredible pain in so many different setups its not even funny.
- Spivak 6y ago
  What are setups where it’s broken? Sincerely. If you can’t accept inbound http traffic then you use DNS verification and if you never contact the internet then no public cert could work for you.
Simon_says 6y ago
Me. I use shared hosting on a server that runs a reverse nginx proxy to my nginx server. I don't have root on the server. I have a LE cert that I need to manually fiddle with DNS settings every 3 months to get. If you know how to automate it I'd love to hear about it.
- wolf550e 6y ago
  Why doesn't their nginx proxy /.well-known/ requests for your domain to your nginx? Then you could just use `certbot certonly --webroot --webroot-path /path/to/webroot/for/your/domain -d your.domain.name -d www.your.domain.name` once and put `certbot renew` and nginx reload in crontab weekly, and you're good to go. If you can't use HTTP-01 and must use DNS-01 challenge, I would check whether the software that runs your host's DNS management panel has an API in addition to manual mode. If not, I would check for ability to automate HTTP requests to that tool (parse the HTML, submit the forms, basically). My hope would be that the tool is popular and someone already did the work and code exists to operate it as if it had an API. If you can do that, you can write (or find one already written) a certbot plugin that performs the DNS challenge using your credentials to the host provided DNS settings. certbot has number of plugins for the big hosting providers: https://github.com/certbot/certbot https://github.com/certbot/certbot certbot is the most popular Let's Encrypt client, but it's not the only one. Maybe another client has support for your situation. I would maybe ask the support of your hosting provider, maybe they know something.
superkuh 6y ago
That's me! I'm technical enough to self-sign for ssl for my sites (it and tor are what I do instead) but I run on lots of old hardware and old (>5 years) OSes. The tools for constantly re-updating letsencrypt simply don't work and all the containerizations didn't exist yet. I've tried nearly a dozen LetsEncrypt updates solutions, compiled from source, from debs, "standalone" only bash solutions, etc, there's always a catch that prevents it from working.
- brian-bk 6y ago
  Are those >5 year OSes receiving security patches?
  - imtringued 6y ago
    They probably receive more security patches than Centos 8 and by that I mean Centos 8 is lagging behind.
tonetheman 6y ago
Lots of people. Such arrogance from those who post on hackernews.
rkagerer 6y ago
The whole "Let's Encrypt should solve all your problems" attitude is arrogant and short-sighted. 1) In my experience the user experience even for technical admins is still flakey on at least some popular platforms. In other words, it's not as incredible as you think. 2) It's not available to a host that doesn't connect to the internet but does occasionally get connected to by a local browser (eg. IoT firewalled inside my LAN is one obvious such case; I'm sure there are others). And most importantly: 3) You'd have to be insane or naive to accept an architecture that leaves you dependant on a single vendor (especially if you need that vendor more than they need you!).
- yjftsjthsd-h 6y ago
  How fortunate, then, that LE isn't the only vendor. Not even the only ACME vendor, nor the only free vendor (https://zerossl.com/features/acme/ https://zerossl.com/features/acme/).
- Spivak 6y ago
  If your device never connects to the internet then how would any public cert work? It would expire like any other?

Semaphor 6y ago

> that still takes some time to set up, manage and maintain over time. I’d say it takes less time than going through a single paid certificate store… Assuming you already have a tool. If you don’t, then maybe it’s the same or 5 minutes more.

floatingatoll 6y ago

One reason for these proposals was to put pressure on the SSL certificate ecosystem to provide (CAs) and adopt (hosting) automated SSL renewal practices. Businesses have had three years since Let's Encrypt first went live to adopt such practices, but many chose not to — not just hosting providers, but e.g. bigcorp load balancers too.

cutler 6y ago
Guess what - not all websites are businesses. In fact not all websites are dynamically-generated so why the fsck do we all have to put up with this madness? Make HTTPS/SSL necessary for transactional sites but for simple static sites give me a break.
- riffic 6y ago
  did you know there are ISPs out there that inject garbage code into the html of unprotected sites? get out of here with this HTTPS is unnecessary tedium.
  - gsich 6y ago
    Better not do business with shady companies then.
    - riffic 6y ago
      or you could follow established best practices and secure your site with TLS.
      - gsich 6y ago
        Both. I am not responsible if you chose a shitty ISP.
        Spivak 6y ago
        But this makes no sense because the user has basically zero control of how their traffic is routed to/from you. If we could trust the entire network we wouldn’t need TLS for any site.

staticassertion 6y ago

Responsibilities have changed a bit. If you're going to host a website you are going to have to put a modicum of effort into ensuring that you are not harming others by doing so.

superkuh 6y ago
>are not harming others How is HTTP harmful when you visit my website about amateur radio? An expired cert is no more harmful than bare http in this non-commercial non-institional personal context. It's the one being discussed in this sub-thread in case you missed it and assumed the normal HN business context. The burden is real and completely unecessary for personal websites. This makes the web more commercial by imposing commercial requirements on everyone. It's what killed off self-signing as a speed bump against massive surveillance and centralized everyone into the benign dictactorship of letsencrypt. But centralization will lead to problems when money is involved. Just look at dot org. The real harm comes from this fetishism of commercial/institutional security models.
- staticassertion 6y ago
  > It's the one being discussed in this sub-thread in case you missed it and assumed the normal HN business context. I did miss that but I did not assume a business context. > The burden is real and completely unecessary for personal websites. Users who visit your website are still at risk of having their connection hijacked - they could be phished, exploited, etc. This is maybe not something you consider important, it is certainly a sort of "boil the ocean" approach, but given the efforts put in up until this point I think it's already the case that most users are probably not visiting HTTP sites on the average day. Continuing that effort seems reasonable. > This makes the web more commercial by imposing commercial requirements on everyone. I'm not sure what you mean.
- cutler 6y ago
  Agreed. I'm sick to the back teeth of fscking with HTTPS/SSL on all the client static sites I manage. Certbot-apache was so flaky I had to switch every client to Nginx so that I could use certbot-nginx. The web has become a no-go zone for do-it-yourselfers. If I didn't setup my clients in VPSs I don't know how we would manage all the mailserver blacklisting and endless HTTPS/SSL requirements.

polishdude20 6y ago

Check out Caddy Server. It was only a few days ago when I was still managing my own certs and renewing them with a Cron job. Caddy now acts as my proxy for my various web domains and it handles certs automatically. Like literally you fill out a few lines in the config called a Caddy file and you do Caddy run and it gets the certs itself. And as long as it's running, it renews them automatically.

dingaling 6y ago
Giving an Internet-connected program autonomous write-access to system-critical filesystems is not considered good practice in production environments. Much better to have a separate central cert management system that handles renewals and pushes the certs outwards to the DMZ systems.
- AlfeG 6y ago
  This is true for enterprise, but for small business Caddy or Traefik is totally fine.
  - mholt 6y ago
    Caddy is good for enterprise use too because of its configurable, pluggable storage backends (doesn't have to be a file system). You can achieve the permission segmenting your company requires. You can also use it as a certificate manager independently of a web server if you want.

blibble 6y ago

it takes absolutely no time at all to set up for an individual on their VPS, compared to the faff of going through the openssl csr process + buying from a CA

cutler 6y ago
"On their VPS". What are you smoking?

luhn 6y ago

There are lots of good options for low-maintenance SSL certificates, from self-hosted (Let's Encrypt) to CDNs (CloudFlare) to hosting platforms (Netlify). Even so, this doesn't actually change much. I've never bought a certificate valid for more than a year. I'm not aware of any major player that sells certificates valid for more than a year. So this rule has existed for a long time in practice, but is only now being codified.

certera 6y ago

Check out Certera https://docs.certera.io https://docs.certera.io It's PKI for Let's Encrypt certificates. Helps you issue, renew, revoke certs from a central place. Also get alerts so you know when things have changed, expired, failed to renew. While a lot of places give you certs built in, there's a whole world of places you still need certs. Like FTP, mail, behind load balancers, disparate environments and systems, etc. In the future, I'm planning on creating a way to automate the certificate exchange process. This should help with using and exchanging certs used in client authentication and things like SAML SSO. If expiration get down to a month or less, I see a need for a system to help do all of these things and more.

GordonS 6y ago
This looks interesting as a log of Let's Encrypt certificate operations, but is it more than that, and why would I want to use it?
- certera 6y ago
  To centrally manage all of your LE certificates, keys, alerting, etc. You can also more easily use LE certs in a wider array of scenarios too. Check out the docs to learn more.
  - GordonS 6y ago
    I did have a look at the docs, but they more explained the how, rather than the why - I missed some kind of intro/overview explaining the value proposition. I'm still a bit fuzzy on this - why would I want alerting, for example? Automation is a big part of LE, and my certs are configured to auto-renew. If that was to fail for some reason, then LE will send me an email - is it this part where this tool comes in, providing improved alerts where automation has failed?
    - certera 6y ago
      That's great feedback. I'll update the docs to better explain the why. To elaborate on the why for alerting, there are many situations that I've seen where things change and subsequently fail silently. Perhaps some dependencies, or maybe configuration changes, caused things to break. Also, alerting doesn't only have to be for your certificates. You can point to any endpoint to monitor as well. There are three aspects of alerting: changes to the cert (perhaps you care about a 3rd party certificate and its underlying key changing), failure to renew, and expirations. Each comes with its own benefits and use cases. To expand on the why a bit further for the project as a whole, it's really as a way to help consolidate and centralize things. I've seen many disparate ways of using Let's Encrypt. From various clients to some hacks to better support more complicated scenarios. By separating obtaining the certificate from applying, it helps facilitate many things, like using LE certs behind load balancers & proxies, non-standard ports, things that don't speak HTTP, etc. If certificate expiration continues to decrease in time, we'll need some capabilities to exchange certificates in an automated fashion as well. I'd also like to incorporate Certificate Transparency logs so you can be sure no one has issued certs for your domain(s). There are many cool and interesting scenarios but mostly the challenges come when managing things at scale. So, it's not really all that useful if you're only managing one or two certs.

deleted 6y ago

[deleted]

lvh 6y ago

I genuinely believe that in 2020 the myriad of ways of getting automated TLS is easier than logging into a website and uploading a CSR and then placing that certificate somewhere.

tinus_hn 6y ago

It is not much harder to do this every year as opposed to doing this every few years. It’s just an incentive to streamline the process.

brian-bk 6y ago

> It's possible and free for small players to use letsencrypt, that still takes some time to set up, manage and maintain over time. If you want to run a webserver but are unable to set up a cronjob that does certbot renew you don't deserve external users. Full stop. If it's just you and you don't care about your own security, then do whatever you want in your own browser.

jjcon 6y ago
> you don't deserve external users. Full stop. It’s shit attitudes like this that killed the old internet we all loved
- brian-bk 6y ago
  It's not wrong to build whatever you want for yourself. But if you have external users on your site sending data to your site, you have a responsibility to not treat your users' data as meaningless.
- xtracto 6y ago
  Don't feed the 5 hour old troll account.
imtringued 6y ago
I have tried to look at the documentation for certbot and the amount effort they put into optimizing the fastpath makes it incredibly difficult to do things manually. The documentation is absolutely awful. Certbot uses .pem files which are practically useless to any JVM based application. So now you got to add your --deploy-hook and add a custom script to convert everything. Don't use any of the blessed DNS providers? Again write your own authentication and cleanup hooks. Suddenly your simple certbot setup involves 3 different scripts that have to be tailored to your specific situation. Sure there are nice blog posts that go through the entire thing but the official documentation basically pretends that your use case doesn't even exist because everyone is running Apache and Nginx, right guys?

user5994461 6y ago

You've got it backward. It is a boon for small players and troubles for large companies. Small players can easily get certificates manually or automate. The platforms/tools they use often give certificates out of the box (cloudflare, heroku, wordpress, etc...). Large players can't manage certificates. Developers/sysadmins can't use let's encrypt because it's prohibited by higher up and blocked. Even if they could use it, it's not supported by their older tools and devices. The last large company I worked for had no automation around certificates and the department that handled certificate requests was sabotaging attempts to automate, possibly out of fear of losing their jobs.