4 ms·

... and it is an nightmare... The web is centralized as it never was before. We have to constantly (every 3 months) renew letsencrypt certificates. They do bre

... and it is an nightmare... The web is centralized as it never was before. We have to constantly (every 3 months) renew letsencrypt certificates. They do breaking changes to the tools and protocols to do that with the same periodicity. Now you need this shitty snap to do that. And private networks devices are still an unsolved problem no one talk about...

watermelon0 5y ago
They claim [1] that they won't be making breaking changes to the protocol, unless absolutely necessary. Many web servers/reverse proxies such as Caddy and Traefik have build-in ACME handling, so as long as you keep them up to date, your certificates should be correctly renewed. From my experience, configuration of ACME with either of them is a breeze. I'm not sure why nginx and Apache don't implement this, considering they are the most popular servers. [1] https://letsencrypt.org/docs/acme-protocol-updates/ https://letsencrypt.org/docs/acme-protocol-updates/
- greatgib 5y ago
  There is no legitimate reason why you would need to keep all your servers updated all the time just because you want to have your cert continuing working. On my case, I was annoyed with an old vps for example because impossible to use docker or snap because you need kernels modules that you don't control in such a setup.
vital_beach 5y ago
I've had several instances of ACME bot deciding to randomly fail behind Cloudflare, so I've switched to using CF Origin certs on a few hosts. It's not ideal, but it works for my public needs. I'm still running PiHole locally with no certs, which I dislike.
glandium 5y ago
I am not using the official tools, but for the one I'm using, I have had to change something exactly once in several years.
benbristow 5y ago
Just always use the latest Docker image of the LetsEncrypt tools. Will always be a working, up to date version that way.

watermelon0 5y ago

They claim [1] that they won't be making breaking changes to the protocol, unless absolutely necessary. Many web servers/reverse proxies such as Caddy and Traefik have build-in ACME handling, so as long as you keep them up to date, your certificates should be correctly renewed. From my experience, configuration of ACME with either of them is a breeze. I'm not sure why nginx and Apache don't implement this, considering they are the most popular servers. [1] https://letsencrypt.org/docs/acme-protocol-updates/ https://letsencrypt.org/docs/acme-protocol-updates/

greatgib 5y ago
There is no legitimate reason why you would need to keep all your servers updated all the time just because you want to have your cert continuing working. On my case, I was annoyed with an old vps for example because impossible to use docker or snap because you need kernels modules that you don't control in such a setup.

vital_beach 5y ago

I've had several instances of ACME bot deciding to randomly fail behind Cloudflare, so I've switched to using CF Origin certs on a few hosts. It's not ideal, but it works for my public needs. I'm still running PiHole locally with no certs, which I dislike.

glandium 5y ago

I am not using the official tools, but for the one I'm using, I have had to change something exactly once in several years.

benbristow 5y ago

Just always use the latest Docker image of the LetsEncrypt tools. Will always be a working, up to date version that way.