8 ms·

Mkcert and certbot are new utilities. OpenSSL predates them by decades. Before acme, someone had to create a CSR manually, often using OpenSSL. Also, should t

Mkcert and certbot are new utilities. OpenSSL predates them by decades. Before acme, someone had to create a CSR manually, often using OpenSSL. Also, should therw be a separate tool to debug and inspect ssl certs and connection? How many individual tools should there be?

sreevisakh 4y ago
Perhaps it's worth mentioning XCA [1] at this point. It's a GUI based on openssl that provides an intuitive UI for managing keys, certs (root CA, intermediate CA, server and client) and CSR. It existed before acme and mkcert. What I liked in XCA was that it made it easy to review all parameters related to the operations it managed. [1] https://hohnstaedt.de/xca/index.php https://hohnstaedt.de/xca/index.php
- Ayesh 4y ago
  I continue to use it even today for small root stores I manage for internal networks. Very clean and intuitive UI that gets the job done well. Also using Kleopatra for GPG keys.
- urda 4y ago
  +1 XCA. It is a fantastic way to manage your own root CA.
tptacek 4y ago
There should be lots of individual tools. I have bad news for you: LetsEncrypt and ACME are almost 10 years old. Like the rest of us, you're getting old.
- vlovich123 4y ago
  LetsEncrypt was founded 7 and started issuing certs about 6 years ago.
- thayne 4y ago
  openssl is more than twice as old as that.
- thayne 4y ago
  > There should be lots of individual tools. Maybe there should be, but for many things that openssl can do (for example, testing and debugging a TLS connection, examining the contents of a certificate, creating a CSR to send to a non-ACME CA, converting between different formats of certificates, etc.) I'm not aware of good single-purpose tools.
- a2800276 4y ago
  > There should be lots of individual tools. Arguably, OpenSSL is a collection of lots of individual tools. Each of the tabs in the "GUI" is an individual command with its own man-page, etc. Each command still brings a lot of of options and therefore complexity with it, but that's because the domain is complex.
maccard 4y ago
> Mkcert and certbot are new utilities. OpenSSL predates them by decades. Certbot has been around for 7 years at this point, and is the same age as VS code. Frankly at this stage there's very little excise to not use it.
- up_o 4y ago
  I use certbot to maintain valid certificates for my website, but there are more use cases for certificates than just https binding--and not all of them lend themselves to LetsEncrypt provisioning. The openssl CLI is definitely not simple, but in my experience it has often been the best available tool for various use cases.
- imtringued 4y ago
  You must use openssl to convert your useless certbot certificates and private keys into something that a Java program can actually use.

sreevisakh 4y ago

Perhaps it's worth mentioning XCA [1] at this point. It's a GUI based on openssl that provides an intuitive UI for managing keys, certs (root CA, intermediate CA, server and client) and CSR. It existed before acme and mkcert. What I liked in XCA was that it made it easy to review all parameters related to the operations it managed. [1] https://hohnstaedt.de/xca/index.php https://hohnstaedt.de/xca/index.php

Ayesh 4y ago
I continue to use it even today for small root stores I manage for internal networks. Very clean and intuitive UI that gets the job done well. Also using Kleopatra for GPG keys.
urda 4y ago
+1 XCA. It is a fantastic way to manage your own root CA.

tptacek 4y ago

There should be lots of individual tools. I have bad news for you: LetsEncrypt and ACME are almost 10 years old. Like the rest of us, you're getting old.

vlovich123 4y ago
LetsEncrypt was founded 7 and started issuing certs about 6 years ago.
thayne 4y ago
openssl is more than twice as old as that.
thayne 4y ago
> There should be lots of individual tools. Maybe there should be, but for many things that openssl can do (for example, testing and debugging a TLS connection, examining the contents of a certificate, creating a CSR to send to a non-ACME CA, converting between different formats of certificates, etc.) I'm not aware of good single-purpose tools.
a2800276 4y ago
> There should be lots of individual tools. Arguably, OpenSSL is a collection of lots of individual tools. Each of the tabs in the "GUI" is an individual command with its own man-page, etc. Each command still brings a lot of of options and therefore complexity with it, but that's because the domain is complex.

maccard 4y ago

> Mkcert and certbot are new utilities. OpenSSL predates them by decades. Certbot has been around for 7 years at this point, and is the same age as VS code. Frankly at this stage there's very little excise to not use it.

up_o 4y ago
I use certbot to maintain valid certificates for my website, but there are more use cases for certificates than just https binding--and not all of them lend themselves to LetsEncrypt provisioning. The openssl CLI is definitely not simple, but in my experience it has often been the best available tool for various use cases.
imtringued 4y ago
You must use openssl to convert your useless certbot certificates and private keys into something that a Java program can actually use.