5 ms·
Self signed is better and more trustworthy. LE’s short cert expiration makes it an enormous pain in the ass. Just put your cert on your site and sign it.
by LoveLeadAcid 5y ago
Self signed is better and more trustworthy. LE’s short cert expiration makes it an enormous pain in the ass. Just put your cert on your site and sign it.
- efficax 5y agoThe whole point of a CA is trust. How do I know a self-signed cert isn't a MITM attack?
- LoveLeadAcid 5y agoAcquire their certificate from a trusted source.
- kjaftaedi 5y agoLike a public certificate authority?
- chris37879 5y agoMaybe we could design a protocol for securing the socket layer, maybe even automate the key exchange so that it's basically transparent to the user, and then why not do the same thing for the people that need certs, let them ask for it whenever they want and provide them a nice tool to automatically renew it. /s
- rfd4sgmk8u 5y agoIts turtles all the way down. You need an anchor of trust. A trust root. This is the public PKI system trusted root store. Even if you obtain the self-signed cert out of band (and explicitly trust it), how do you authenticate that channel? Self-signed certs are not scalable or particularly useful for internet users. Please don't recommend this.
- max1cc 5y ago? I could understand if you had to renew manually/upload a new cert every 90 days but it does it all automatically for you doesn't it
- kaidon 5y agoNot really. But with tools like CertBot and ACME Terraform Providers, (or just a periodic cronjob), it's not too difficult to keep your certs up to date. (just don't spam their prod provisioning servers).
- ehutch79 5y agoKaidon is correct If your 'lets encrypt' cert is not renewing on a chron job or something you are doing it wrong. Every guide I've seen involves setting this up.