3 ms·

In case anyone is left wondering amout what specifically has changed and whether they might also have problems manifest suddenly: https://letsencrypt.org/docs/

by brazzy 6y ago

In case anyone is left wondering amout what specifically has changed and whether they might also have problems manifest suddenly: https://letsencrypt.org/docs/acme-protocol-updates/ https://letsencrypt.org/docs/acme-protocol-updates/ https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430 https://community.letsencrypt.org/t/end-of-life-plan-for-acm... So this has been planned for quite some time, and if you have a current Letsencrypt client, it should keep working seamlessly. But yeah, if you have servers running an old OS release that won't get a new certbot version, that's gonna suck.

jacquesm 6y ago
Why force people to upgrade if it isn't necessary? Was there a huge price on the side of LE to keep the old protocol up and running until it was no longer in use? Is that price balanced out by the combined cost of the users having to upgrade their systems, something that typically costs a day or more per installation?
- brazzy 6y ago
  Reading between the lines, it seems the v1 protocol was basically a proof of concept implementation and differs in some points from the final RFC specification. With Letsencrypt being by far the most popular ACME provider, if they kept running the old version even optionally, there would be very little incentive for clients to start supporting the standard instead of the POC. I can understand how they don't want to be the IE6 of CAs.
  - jacquesm 6y ago
    Unless there was an incurable security issue in the V1 protocol I see no reason to force an upgrade on the part of untold millions of installations.
- hyder_m29 6y ago
  From the linked article above > In November of 2019 we will stop allowing new account registrations through our ACMEv1 API endpoint. _Existing accounts will continue to function normally._
  - jacquesm 6y ago
    Except that a new domain counts as a new account.
    - chmike 6y ago
      That is not true. In fact you have an account key that identifies you and the account. With that account you can create and update the certificates of many domains.
      - jacquesm 6y ago
        Well, that's an implementation detail for Mailinabox, which I do not have sufficient insight in but as far as I know all the domains on that machine share the same account key, and an attempt to manually update one of these gave the exact same error as the mailinabox UI. So either miab uses one account per domain (which is very well possible, but that detail is not exposed) or something else is wrong.

by brazzy 6y ago

jacquesm 6y ago

Why force people to upgrade if it isn't necessary? Was there a huge price on the side of LE to keep the old protocol up and running until it was no longer in use? Is that price balanced out by the combined cost of the users having to upgrade their systems, something that typically costs a day or more per installation?

brazzy 6y ago
Reading between the lines, it seems the v1 protocol was basically a proof of concept implementation and differs in some points from the final RFC specification. With Letsencrypt being by far the most popular ACME provider, if they kept running the old version even optionally, there would be very little incentive for clients to start supporting the standard instead of the POC. I can understand how they don't want to be the IE6 of CAs.
- jacquesm 6y ago
  Unless there was an incurable security issue in the V1 protocol I see no reason to force an upgrade on the part of untold millions of installations.
hyder_m29 6y ago
From the linked article above > In November of 2019 we will stop allowing new account registrations through our ACMEv1 API endpoint. _Existing accounts will continue to function normally._
- jacquesm 6y ago
  Except that a new domain counts as a new account.
  - chmike 6y ago
    That is not true. In fact you have an account key that identifies you and the account. With that account you can create and update the certificates of many domains.
    - jacquesm 6y ago
      Well, that's an implementation detail for Mailinabox, which I do not have sufficient insight in but as far as I know all the domains on that machine share the same account key, and an attempt to manually update one of these gave the exact same error as the mailinabox UI. So either miab uses one account per domain (which is very well possible, but that detail is not exposed) or something else is wrong.