4 ms·

I know better what am I supposed to do. Type "download letsencrypt certificate online" in the Google and you'll find out what I'm talking about. You can think o

I know better what am I supposed to do. Type "download letsencrypt certificate online" in the Google and you'll find out what I'm talking about. You can think of forcing administrators all the day while Internet is full of expired letsencrypt websites that I regularly stumble upon. The world does not work like that. Letsencrypt should serve its users, not force them onto anything. If I think that I should generate key online, provide me this service with sane implementation on a safe website. If you won't, I'll download it from the "Russian hackers". ACME is awesome, but it's not always suitable, sometimes I want to get certificate manually and that's OK. I remember chinese websites issuing 3-year certificates. Wosign or something like that. That was the best experience I've ever had.

piperswe 4y ago
If people want longer certificate lifespans, they can get their certificates elsewhere. Part of the deal with getting a free certificate is that you're supposed to set up autorenewal with ACME. If you can't or don't want to do that, there are plenty of other CAs out there that will get you a long-life certificate.
- bombcar 4y ago
  Nobody offers more than a year now. It’s annoying. So many old devices still need to be supported and can’t automatically update.
  - NavinF 4y ago
    If these devices have internet access they can auto renew. If they don't, they don't need a cert signed by a public CA.
    - Cogito 4y ago
      I partly agree with you, however it's possible for devices to have limited access to the internet, or even no direct access but still be accessible to devices that are on the internet. If I have a smart device at home I may put it on a network that has no outgoing access to the internet, but it would still be nice to be able to connect to it with a web browser without getting angry expired certificate warnings. It's not the worst problem to have, and I don't think it's easy to fix, but it's still annoying.
      - progmetaldev 4y ago
        A company extranet locked by a whitelist of IP addresses comes to mind. You still want a SSL installed for security.
        NavinF 4y ago
        Yeah but that's a lot less common these days: https://www.usenix.org/system/files/login/articles/login_dec14_02_ward.pdf https://www.usenix.org/system/files/login/articles/login_dec... I don't want LE to waste money supporting such use cases.
        bombcar 4y ago
        Ever since LE added wildcards it’s not as bad - get the cert on one machine, copy it via scripts to all.
    - bombcar 4y ago
      Is there a certbot client for ESXi?
  - duskwuff 4y ago
    > Nobody offers more than a year now. Correct, because the CA/Browser Forum no longer permits CAs to issue certificates with validity longer than 13 months: https://pkic.org/2020/07/09/one-year-certs/ https://pkic.org/2020/07/09/one-year-certs/
NavinF 4y ago
> Type "download letsencrypt certificate online" in the Google > generate key online, provide me this service with sane implementation on a safe website Well there's your problem right there. Either go on youtube and watch some videos about how TLS works or just use an http server like Caddy that automatically generates TLS certs and renews them with Let's Encrypt.
jiggawatts 4y ago
> Letsencrypt should serve its users, not force them onto anything. The only way they can serve users is by forcing them to do the right thing. You're insisting on doing the wrong thing and shouting at the people that are telling you how to do it right. An analogy would be the equivalent of "not your wallet, not your crypto". Literally millions of naive crypto enthusiasts have just had $9B stolen from them by FTX because they didn't grasp this basic concept. They just wanted something convenient. With something like PKI or cryptocoins, there are no shortcuts to security. It's like sticky-taping your key to your locked front door. Or writing your pin code on your credit card. Or setting your password to "12345".
kelnos 4y ago
No one is stopping you from getting a 1-year cert from another CA and using that. If you do not like the process LetsEncrypt uses, then you are not in their target market. That's fine; move on and use something else. > I remember chinese websites issuing 3-year certificates. Wosign or something like that. That was the best experience I've ever had. I remember Wosign! Man, what a terrible experience. The last thing I want is be forced to do system administration tasks manually by clicking around on a website. To be fair, it was great that it was available for its time, but I would never want to go back to something like that.

piperswe 4y ago

If people want longer certificate lifespans, they can get their certificates elsewhere. Part of the deal with getting a free certificate is that you're supposed to set up autorenewal with ACME. If you can't or don't want to do that, there are plenty of other CAs out there that will get you a long-life certificate.

bombcar 4y ago
Nobody offers more than a year now. It’s annoying. So many old devices still need to be supported and can’t automatically update.
- NavinF 4y ago
  If these devices have internet access they can auto renew. If they don't, they don't need a cert signed by a public CA.
  - Cogito 4y ago
    I partly agree with you, however it's possible for devices to have limited access to the internet, or even no direct access but still be accessible to devices that are on the internet. If I have a smart device at home I may put it on a network that has no outgoing access to the internet, but it would still be nice to be able to connect to it with a web browser without getting angry expired certificate warnings. It's not the worst problem to have, and I don't think it's easy to fix, but it's still annoying.
    - progmetaldev 4y ago
      A company extranet locked by a whitelist of IP addresses comes to mind. You still want a SSL installed for security.
      - NavinF 4y ago
        Yeah but that's a lot less common these days: https://www.usenix.org/system/files/login/articles/login_dec14_02_ward.pdf https://www.usenix.org/system/files/login/articles/login_dec... I don't want LE to waste money supporting such use cases.
        bombcar 4y ago
        Ever since LE added wildcards it’s not as bad - get the cert on one machine, copy it via scripts to all.
  - bombcar 4y ago
    Is there a certbot client for ESXi?
- duskwuff 4y ago
  > Nobody offers more than a year now. Correct, because the CA/Browser Forum no longer permits CAs to issue certificates with validity longer than 13 months: https://pkic.org/2020/07/09/one-year-certs/ https://pkic.org/2020/07/09/one-year-certs/

NavinF 4y ago

> Type "download letsencrypt certificate online" in the Google > generate key online, provide me this service with sane implementation on a safe website Well there's your problem right there. Either go on youtube and watch some videos about how TLS works or just use an http server like Caddy that automatically generates TLS certs and renews them with Let's Encrypt.

jiggawatts 4y ago

> Letsencrypt should serve its users, not force them onto anything. The only way they can serve users is by forcing them to do the right thing. You're insisting on doing the wrong thing and shouting at the people that are telling you how to do it right. An analogy would be the equivalent of "not your wallet, not your crypto". Literally millions of naive crypto enthusiasts have just had $9B stolen from them by FTX because they didn't grasp this basic concept. They just wanted something convenient. With something like PKI or cryptocoins, there are no shortcuts to security. It's like sticky-taping your key to your locked front door. Or writing your pin code on your credit card. Or setting your password to "12345".

kelnos 4y ago

No one is stopping you from getting a 1-year cert from another CA and using that. If you do not like the process LetsEncrypt uses, then you are not in their target market. That's fine; move on and use something else. > I remember chinese websites issuing 3-year certificates. Wosign or something like that. That was the best experience I've ever had. I remember Wosign! Man, what a terrible experience. The last thing I want is be forced to do system administration tasks manually by clicking around on a website. To be fair, it was great that it was available for its time, but I would never want to go back to something like that.