3 ms·

> You need to pay attention to it If I have to pay attention to it four times a year and regularly spend a day updating software I didn't want to have let alon

> You need to pay attention to it If I have to pay attention to it four times a year and regularly spend a day updating software I didn't want to have let alone update, I should have just paid GoDaddy or whoever their $100 grift and only had to update the cert once a year and not hunt down stupid error messages and look for release notes on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard.' Amazon haven't done something this stupid with their 'free" ssl certs for load balancers, and you know why? Because the provide them to "customers", not to "early adopting cheapskate beta testing schmucks"...

wongarsu 6y ago
>and you know why? because they control the software on both ends and can update certificate clients on the load balancers anytime they want?
PaulKeeble 6y ago
It is actually easier to deploy a repeat certificate you bought as well. Once you have it all setup it is usually just a drop in replacement and a config reload of the web server. Multiple times now I have spent hours fiddling with certbot trying to get it to do its job properly and stop invalidating my certificates. SSL has never been as much hassle as it has been with letsencrypt. Its free and I feel like I am getting what I paid for!
perlgeek 6y ago
I've been using let's encrypt nearly since it started issuing certificates, and I had to intervene only once so far. I think one thing that's missing from the discussion is scalability. Sure you can pay a CA for a cert that is valid for a year, but you still have to do your update dance once per year per site. With let's encrypt, you write an Ansible playbook (or whatever it is you use for automation) once, run it everywhere. You select a TLS monitoring service (or run your own) once, enter your URLs, and you're done. You only have to intervene when problems arise (and that can happen with CAs that you have paid as well).
abiogenesis 6y ago
The root CA certificate used to sign the AWS RDS certificates has recently expired and everyone needed to update the root store on their servers. Those who didn't pay attention lost connection to their database: https://aws.amazon.com/blogs/database/amazon-rds-customers-update-your-ssl-tls-certificates-by-february-5-2020/ https://aws.amazon.com/blogs/database/amazon-rds-customers-u...

wongarsu 6y ago

>and you know why? because they control the software on both ends and can update certificate clients on the load balancers anytime they want?

PaulKeeble 6y ago

It is actually easier to deploy a repeat certificate you bought as well. Once you have it all setup it is usually just a drop in replacement and a config reload of the web server. Multiple times now I have spent hours fiddling with certbot trying to get it to do its job properly and stop invalidating my certificates. SSL has never been as much hassle as it has been with letsencrypt. Its free and I feel like I am getting what I paid for!

perlgeek 6y ago

I've been using let's encrypt nearly since it started issuing certificates, and I had to intervene only once so far. I think one thing that's missing from the discussion is scalability. Sure you can pay a CA for a cert that is valid for a year, but you still have to do your update dance once per year per site. With let's encrypt, you write an Ansible playbook (or whatever it is you use for automation) once, run it everywhere. You select a TLS monitoring service (or run your own) once, enter your URLs, and you're done. You only have to intervene when problems arise (and that can happen with CAs that you have paid as well).

abiogenesis 6y ago

The root CA certificate used to sign the AWS RDS certificates has recently expired and everyone needed to update the root store on their servers. Those who didn't pay attention lost connection to their database: https://aws.amazon.com/blogs/database/amazon-rds-customers-update-your-ssl-tls-certificates-by-february-5-2020/ https://aws.amazon.com/blogs/database/amazon-rds-customers-u...