3 ms·

Close to none. Just a letsencrypt cert and not completely outdated ciphers is enough.

by phicoh 5y ago

nottorp 5y ago
:) "Just a letsencrypt cert". That's right for me and most off the HN audience. Is it right for the general public?
- throw0101a 5y ago
  > Is it right for the general public? My Asus router has a checkbox for dynamic DNS and for getting Let's Encrypt certs. See Method 2: * https://www.asus.com/us/support/FAQ/1034294/#a2 https://www.asus.com/us/support/FAQ/1034294/#a2
- LinuxBender 5y ago
  Yes. Even the most complex technical setup can be accomplished by a non-technical person that can follow directions assuming that someone took the time to write clear and concise directions and included common caveats and troubles that one may run into and where to check for them. I have proven this many times over by having managers and directors that were non-technical follow my instructions. In the rare moments this breaks down, forums and chat rooms can be a very handy gap-filler and provides an indirect feedback loop to further improve documentation.
- phicoh 5y ago
  Yes, because if you web server publicly reachable, letencrypt can be automated easily. And there is plenty of letsencrypt software that does fully automates this. A public web server is the easy part if you want to do letsencrypt.
  - vetinari 5y ago
    Letsencrypt is easy, if you are running generic Linux distribution and can easily install whatever you want. But you might run a device that already comes with software, and letsencrypt support is either limited (example: Synology; their implementation allows only http-01 challenge so if you need dns-01, tough luck. Even wildcards are a new feature) or non-existent (example: Ubiquiti, and their cloud keys (administration UI, guest portal) or routers (Radius/WPA Enterprise needs TLS cert too)).
    - throw0101a 5y ago
      dns-01 is possible on Synology, but you need to SSH in: * https://github.com/acmesh-official/acme.sh/wiki/Synology-NAS-Guide https://github.com/acmesh-official/acme.sh/wiki/Synology-NAS... * https://lippertmarkus.com/2020/03/14/synology-le-dns-auto-renew/ https://lippertmarkus.com/2020/03/14/synology-le-dns-auto-re... * http://www.thedreaming.org/2020/11/18/synology-lets-encrypt/ http://www.thedreaming.org/2020/11/18/synology-lets-encrypt/ It's possible as long as your ACME client has hook scripts, and your DNS provider has an API: * https://github.com/AnalogJ/lexicon https://github.com/AnalogJ/lexicon
    - andrewaylett 5y ago
      It's unofficial, but https://github.com/kchristensen/udm-le https://github.com/kchristensen/udm-le lets you provision LetsEncrypt certificates for Ubiquiti kit.
- beebeepka 5y ago
  Is the general public that much into running private web services on their home networks?
- nicce 5y ago
  That is the lowest bar for setting your certificates. It should be right for the general public.
- selfhoster11 5y ago
  The general public's alternative is to buy a cert every year for $$. They'll figure it out. (or their shared hosting provider will)
- bawolff 5y ago
  Which audience exactly is cool with the register a domain name, figure out your ip, setup an A record to point there (maybe dynamically!), enable port forwarding, install a web server, etc, but gets stuck on letsencrypt? Letsencrypt is almost certainly the easiest part of the entire process of self-hosting a website.

Close to none. Just a letsencrypt cert and not completely outdated ciphers is enough.

by phicoh 5y ago

Close to none. Just a letsencrypt cert and not completely outdated ciphers is enough.

nottorp 5y ago

:) "Just a letsencrypt cert". That's right for me and most off the HN audience. Is it right for the general public?

throw0101a 5y ago
> Is it right for the general public? My Asus router has a checkbox for dynamic DNS and for getting Let's Encrypt certs. See Method 2: * https://www.asus.com/us/support/FAQ/1034294/#a2 https://www.asus.com/us/support/FAQ/1034294/#a2
LinuxBender 5y ago
Yes. Even the most complex technical setup can be accomplished by a non-technical person that can follow directions assuming that someone took the time to write clear and concise directions and included common caveats and troubles that one may run into and where to check for them. I have proven this many times over by having managers and directors that were non-technical follow my instructions. In the rare moments this breaks down, forums and chat rooms can be a very handy gap-filler and provides an indirect feedback loop to further improve documentation.
phicoh 5y ago
Yes, because if you web server publicly reachable, letencrypt can be automated easily. And there is plenty of letsencrypt software that does fully automates this. A public web server is the easy part if you want to do letsencrypt.
- vetinari 5y ago
  Letsencrypt is easy, if you are running generic Linux distribution and can easily install whatever you want. But you might run a device that already comes with software, and letsencrypt support is either limited (example: Synology; their implementation allows only http-01 challenge so if you need dns-01, tough luck. Even wildcards are a new feature) or non-existent (example: Ubiquiti, and their cloud keys (administration UI, guest portal) or routers (Radius/WPA Enterprise needs TLS cert too)).
  - throw0101a 5y ago
    dns-01 is possible on Synology, but you need to SSH in: * https://github.com/acmesh-official/acme.sh/wiki/Synology-NAS-Guide https://github.com/acmesh-official/acme.sh/wiki/Synology-NAS... * https://lippertmarkus.com/2020/03/14/synology-le-dns-auto-renew/ https://lippertmarkus.com/2020/03/14/synology-le-dns-auto-re... * http://www.thedreaming.org/2020/11/18/synology-lets-encrypt/ http://www.thedreaming.org/2020/11/18/synology-lets-encrypt/ It's possible as long as your ACME client has hook scripts, and your DNS provider has an API: * https://github.com/AnalogJ/lexicon https://github.com/AnalogJ/lexicon
  - andrewaylett 5y ago
    It's unofficial, but https://github.com/kchristensen/udm-le https://github.com/kchristensen/udm-le lets you provision LetsEncrypt certificates for Ubiquiti kit.
beebeepka 5y ago
Is the general public that much into running private web services on their home networks?
nicce 5y ago
That is the lowest bar for setting your certificates. It should be right for the general public.
selfhoster11 5y ago
The general public's alternative is to buy a cert every year for $$. They'll figure it out. (or their shared hosting provider will)
bawolff 5y ago
Which audience exactly is cool with the register a domain name, figure out your ip, setup an A record to point there (maybe dynamically!), enable port forwarding, install a web server, etc, but gets stuck on letsencrypt? Letsencrypt is almost certainly the easiest part of the entire process of self-hosting a website.