6 ms·

Can you describe the kind of person who hosts their own website but cannot easily set up Let's Encrypt automatic renewal?

raverbashing 6y ago
Shared hosting Unless they set up LtE for their customers (And as much as I like LtE I think it's complicate to depend in one issuer only)
- DiederikvandenB 6y ago
  Semaphor asks "can you describe the kind of person". Since when is "shared hosting" a person? People who know how to set up a website on a shared hosting platform probably also know how to renew a LE certificate, I think.
maxmalysh 6y ago
http://www.paulgraham.com/ http://www.paulgraham.com/
- brian-bk 6y ago
  There's no cert because there's no need for one in the first place. Mentioning that is pretty silly - it's obvious that there's nothing wrong with a static site with now cert, and no one is arguing against that.
  - maxmalysh 6y ago
    > there's nothing wrong with a static site with no cert Not really. Google says "switch to HTTPS or lose ranking": https://webmasters.googleblog.com/2014/08/https-as-ranking-signal.html https://webmasters.googleblog.com/2014/08/https-as-ranking-s...
    - brian-bk 6y ago
      Good to note. But I think you're distracting from the article's talking point. I disagree with "switch to HTTPS or lose ranking", but that's an HTTP vs. HTTPS issue with Google's search ranking, not about Chromium or Mozilla. This article is about Chromium & Mozilla making stricter rules for HTTPS certificates. That's not a bad thing, to hold HTTPS sites to a better standard.
  - riffic 6y ago
    > no need for one in the first place ... it's obvious that there's nothing wrong with a static site with no cert Oh yes, there is. https://doesmysiteneedhttps.com https://doesmysiteneedhttps.com > YES > Your site needs HTTPS.
cm2187 6y ago
Devices with web based interface (KVM over IP, IPMI, etc).
- Spivak 6y ago
  iDRAC has a CLI tool that can be instrumented to install new certs regularly. I’m sure other vendors do as well.
waheoo 6y ago
Letsencrypt is broken or an incredible pain in so many different setups its not even funny.
- Spivak 6y ago
  What are setups where it’s broken? Sincerely. If you can’t accept inbound http traffic then you use DNS verification and if you never contact the internet then no public cert could work for you.
Simon_says 6y ago
Me. I use shared hosting on a server that runs a reverse nginx proxy to my nginx server. I don't have root on the server. I have a LE cert that I need to manually fiddle with DNS settings every 3 months to get. If you know how to automate it I'd love to hear about it.
- wolf550e 6y ago
  Why doesn't their nginx proxy /.well-known/ requests for your domain to your nginx? Then you could just use `certbot certonly --webroot --webroot-path /path/to/webroot/for/your/domain -d your.domain.name -d www.your.domain.name` once and put `certbot renew` and nginx reload in crontab weekly, and you're good to go. If you can't use HTTP-01 and must use DNS-01 challenge, I would check whether the software that runs your host's DNS management panel has an API in addition to manual mode. If not, I would check for ability to automate HTTP requests to that tool (parse the HTML, submit the forms, basically). My hope would be that the tool is popular and someone already did the work and code exists to operate it as if it had an API. If you can do that, you can write (or find one already written) a certbot plugin that performs the DNS challenge using your credentials to the host provided DNS settings. certbot has number of plugins for the big hosting providers: https://github.com/certbot/certbot https://github.com/certbot/certbot certbot is the most popular Let's Encrypt client, but it's not the only one. Maybe another client has support for your situation. I would maybe ask the support of your hosting provider, maybe they know something.
superkuh 6y ago
That's me! I'm technical enough to self-sign for ssl for my sites (it and tor are what I do instead) but I run on lots of old hardware and old (>5 years) OSes. The tools for constantly re-updating letsencrypt simply don't work and all the containerizations didn't exist yet. I've tried nearly a dozen LetsEncrypt updates solutions, compiled from source, from debs, "standalone" only bash solutions, etc, there's always a catch that prevents it from working.
- brian-bk 6y ago
  Are those >5 year OSes receiving security patches?
  - imtringued 6y ago
    They probably receive more security patches than Centos 8 and by that I mean Centos 8 is lagging behind.
tonetheman 6y ago
Lots of people. Such arrogance from those who post on hackernews.
rkagerer 6y ago
The whole "Let's Encrypt should solve all your problems" attitude is arrogant and short-sighted. 1) In my experience the user experience even for technical admins is still flakey on at least some popular platforms. In other words, it's not as incredible as you think. 2) It's not available to a host that doesn't connect to the internet but does occasionally get connected to by a local browser (eg. IoT firewalled inside my LAN is one obvious such case; I'm sure there are others). And most importantly: 3) You'd have to be insane or naive to accept an architecture that leaves you dependant on a single vendor (especially if you need that vendor more than they need you!).
- yjftsjthsd-h 6y ago
  How fortunate, then, that LE isn't the only vendor. Not even the only ACME vendor, nor the only free vendor (https://zerossl.com/features/acme/ https://zerossl.com/features/acme/).
- Spivak 6y ago
  If your device never connects to the internet then how would any public cert work? It would expire like any other?

raverbashing 6y ago

Shared hosting Unless they set up LtE for their customers (And as much as I like LtE I think it's complicate to depend in one issuer only)

DiederikvandenB 6y ago
Semaphor asks "can you describe the kind of person". Since when is "shared hosting" a person? People who know how to set up a website on a shared hosting platform probably also know how to renew a LE certificate, I think.

maxmalysh 6y ago

http://www.paulgraham.com/ http://www.paulgraham.com/

brian-bk 6y ago
There's no cert because there's no need for one in the first place. Mentioning that is pretty silly - it's obvious that there's nothing wrong with a static site with now cert, and no one is arguing against that.
- maxmalysh 6y ago
  > there's nothing wrong with a static site with no cert Not really. Google says "switch to HTTPS or lose ranking": https://webmasters.googleblog.com/2014/08/https-as-ranking-signal.html https://webmasters.googleblog.com/2014/08/https-as-ranking-s...
  - brian-bk 6y ago
    Good to note. But I think you're distracting from the article's talking point. I disagree with "switch to HTTPS or lose ranking", but that's an HTTP vs. HTTPS issue with Google's search ranking, not about Chromium or Mozilla. This article is about Chromium & Mozilla making stricter rules for HTTPS certificates. That's not a bad thing, to hold HTTPS sites to a better standard.
- riffic 6y ago
  > no need for one in the first place ... it's obvious that there's nothing wrong with a static site with no cert Oh yes, there is. https://doesmysiteneedhttps.com https://doesmysiteneedhttps.com > YES > Your site needs HTTPS.

cm2187 6y ago

Devices with web based interface (KVM over IP, IPMI, etc).

Spivak 6y ago
iDRAC has a CLI tool that can be instrumented to install new certs regularly. I’m sure other vendors do as well.

waheoo 6y ago

Letsencrypt is broken or an incredible pain in so many different setups its not even funny.

Spivak 6y ago
What are setups where it’s broken? Sincerely. If you can’t accept inbound http traffic then you use DNS verification and if you never contact the internet then no public cert could work for you.

Simon_says 6y ago

Me. I use shared hosting on a server that runs a reverse nginx proxy to my nginx server. I don't have root on the server. I have a LE cert that I need to manually fiddle with DNS settings every 3 months to get. If you know how to automate it I'd love to hear about it.

wolf550e 6y ago
Why doesn't their nginx proxy /.well-known/ requests for your domain to your nginx? Then you could just use `certbot certonly --webroot --webroot-path /path/to/webroot/for/your/domain -d your.domain.name -d www.your.domain.name` once and put `certbot renew` and nginx reload in crontab weekly, and you're good to go. If you can't use HTTP-01 and must use DNS-01 challenge, I would check whether the software that runs your host's DNS management panel has an API in addition to manual mode. If not, I would check for ability to automate HTTP requests to that tool (parse the HTML, submit the forms, basically). My hope would be that the tool is popular and someone already did the work and code exists to operate it as if it had an API. If you can do that, you can write (or find one already written) a certbot plugin that performs the DNS challenge using your credentials to the host provided DNS settings. certbot has number of plugins for the big hosting providers: https://github.com/certbot/certbot https://github.com/certbot/certbot certbot is the most popular Let's Encrypt client, but it's not the only one. Maybe another client has support for your situation. I would maybe ask the support of your hosting provider, maybe they know something.

superkuh 6y ago

That's me! I'm technical enough to self-sign for ssl for my sites (it and tor are what I do instead) but I run on lots of old hardware and old (>5 years) OSes. The tools for constantly re-updating letsencrypt simply don't work and all the containerizations didn't exist yet. I've tried nearly a dozen LetsEncrypt updates solutions, compiled from source, from debs, "standalone" only bash solutions, etc, there's always a catch that prevents it from working.

brian-bk 6y ago
Are those >5 year OSes receiving security patches?
- imtringued 6y ago
  They probably receive more security patches than Centos 8 and by that I mean Centos 8 is lagging behind.

tonetheman 6y ago

Lots of people. Such arrogance from those who post on hackernews.

rkagerer 6y ago

The whole "Let's Encrypt should solve all your problems" attitude is arrogant and short-sighted. 1) In my experience the user experience even for technical admins is still flakey on at least some popular platforms. In other words, it's not as incredible as you think. 2) It's not available to a host that doesn't connect to the internet but does occasionally get connected to by a local browser (eg. IoT firewalled inside my LAN is one obvious such case; I'm sure there are others). And most importantly: 3) You'd have to be insane or naive to accept an architecture that leaves you dependant on a single vendor (especially if you need that vendor more than they need you!).

yjftsjthsd-h 6y ago
How fortunate, then, that LE isn't the only vendor. Not even the only ACME vendor, nor the only free vendor (https://zerossl.com/features/acme/ https://zerossl.com/features/acme/).
Spivak 6y ago
If your device never connects to the internet then how would any public cert work? It would expire like any other?