3 ms·
Let’s Encrypt ACME is a service that many depend on for their services, like Netlify, Synology, or Digital Ocean. It is true that existing certificates on exist
by jchw 5y ago
Let’s Encrypt ACME is a service that many depend on for their services, like Netlify, Synology, or Digital Ocean. It is true that existing certificates on existing hosts shouldn’t be impacted, but new certificates will be, and in my opinion that does actually matter. There may even be legitimate use cases for lazily grabbing certs in the request path; it’s pretty easy to do given that the Go ACME integrations basically do this plus some caching and scheduled renewal logic.
This is of course aside from the OCSP point that others are noting, which does at least make PKI downtime a little more sketchy.
- jopsen 5y ago> There may even be legitimate use cases for lazily grabbing certs in the request path; Anything springs to mind? If you're using per-user sub-domains on your service, I'd imagine you'd be using wildcard certificates.
- dharmab 5y agoWhy use a wildcard? They're expensive and if compromised have a large blast radius.
- jchw 5y agoLE limits the number of subdomains you can request on a given domain, so it is probably somewhat necessary to use wildcard certs.
- jchw 5y agoHow about this: a service that runs on a customer’s own domain, under a subdomain. Think blogging, GitHub issues, some kinds of SaaS products. Seems like something not covered by wild cards that would not be thwarted by LE rate limits and probably is useful in practice.