3 ms·
Chef + reliable CAs other than Let's Encrypt that have an API = the end. Invest in: 0. Automation 1. Documentation 2. Take away SSH 3. Except for data stor
by 1letterunixname 4y ago
Chef + reliable CAs other than Let's Encrypt that have an API = the end.
Invest in:
0. Automation
1. Documentation
2. Take away SSH
3. Except for data stores, ephemeralize servers so they can be blown away and automatically reprovisioned
4. Have tested backups (untested aren't backups)
5. Save time
6. Solve other, bigger problems
- vladvasiliu 4y ago> reliable CAs other than Let's Encrypt that have an API Would you care to give an example or two?
- TonyTrapp 4y agoLet's Encrypt's ACME protocol has been adopted by ZeroSSL, Buypass and ssl.com to offer free 90-day certificates.
- 1letterunixname 4y agoFree CAs are prone to fraud and abuse because they have no innate funding model and there's no barrier to anyone issuing a cert to any particular domain while attempting to circumvent domain authentication.
- TonyTrapp 4y ago> there's no barrier to anyone issuing a cert to any particular domain while attempting to circumvent domain authentication. Let's Encrypt has a much better track record at preventing people from issuing certs for random domains compared to many other commercial entities.