3 ms·
Given that OP is a self-proclaimed "update hater", I guess the reason they don't get a 5 year commercial cert is cost? In that case whining online about it seem
by ht85 6y ago
Given that OP is a self-proclaimed "update hater", I guess the reason they don't get a 5 year commercial cert is cost? In that case whining online about it seems uncalled for.
Also from an architecture standpoint, the post seems to suggest that OP has certbot running on a variety of machines throughout his infrastructure. If you have many servers relying on letsencrypt, you probably want to centralize generating certificates somewhere, and have other machines pull from there.
- SyneRyder 6y ago> I guess the reason they don't get a 5 year commercial cert is cost? Web browsers no longer support 5 year certificates. The new maximum is 1 year as of last week, with a view to make that duration even shorter over time as certificate renewal & automated updates become more widespread. https://nakedsecurity.sophos.com/2020/02/24/apple-chops-safaris-tls-certificate-validity-down-to-one-year/ https://nakedsecurity.sophos.com/2020/02/24/apple-chops-safa...
- ht85 6y agoThanks, wasn't aware of that, very interesting!
- jacquesm 6y agoYou apparently did not understand that article very well. I'm all for updates. I'm 100% on board with security related updates and bug fixes. I'm very much against updates that break things, move things, surprise the user, include bloat and a hundred other violations of trust that get pushed upon users. And this is actually a nice case of such a thing: a protocol on a server that I have no control over got changed. And that now requires me to do a bunch of work to no gain for myself and at the expense of a bunch of time when when I had other plans.