2 ms·
Yep. Either ACME, or some other reliable method to automate cert issuing. Manual cert deployment is IMHO bad hygiene in this day and age. (Yes, I know there’s
by cpach 4y ago
Yep. Either ACME, or some other reliable method to automate cert issuing.
Manual cert deployment is IMHO bad hygiene in this day and age. (Yes, I know there’s esoteric hardware and stuff like that where automation isn’t straight-forward, but that’s the exception, not the rule.)
E.g. on AWS there’s Certificate Manager, which is similar. (But obviously only usable for people on AWS.)
- blueflow 4y agoIts not dependend on manual deployment, you can as well automate it wrongly.
- cpach 4y agoSure. But then you have the chance to fix your automation logic.
- lbriner 4y ago> Yes, I know there’s esoteric hardware and stuff like that where automation isn’t straight-forward, but that’s the exception, not the rule. Maybe in your world but plenty of us work in places that have 1000s of servers, many of them internal, they don't support LE or there are security concerns with opening external firewalls just to support certificate updates so it still has to be done manually. You might be lucky to work somewhere much smaller/newer that doesn't have the problem but please don't make disparaging statements about those of us who have to do this manually.
- cpach 4y agoIt’s still possible to automate cert minting. For example, you can have your own internal CA that’s not connected to the Internet.