4 ms·

If people want longer certificate lifespans, they can get their certificates elsewhere. Part of the deal with getting a free certificate is that you're supposed

If people want longer certificate lifespans, they can get their certificates elsewhere. Part of the deal with getting a free certificate is that you're supposed to set up autorenewal with ACME. If you can't or don't want to do that, there are plenty of other CAs out there that will get you a long-life certificate.

bombcar 4y ago
Nobody offers more than a year now. It’s annoying. So many old devices still need to be supported and can’t automatically update.
- NavinF 4y ago
  If these devices have internet access they can auto renew. If they don't, they don't need a cert signed by a public CA.
  - Cogito 4y ago
    I partly agree with you, however it's possible for devices to have limited access to the internet, or even no direct access but still be accessible to devices that are on the internet. If I have a smart device at home I may put it on a network that has no outgoing access to the internet, but it would still be nice to be able to connect to it with a web browser without getting angry expired certificate warnings. It's not the worst problem to have, and I don't think it's easy to fix, but it's still annoying.
    - progmetaldev 4y ago
      A company extranet locked by a whitelist of IP addresses comes to mind. You still want a SSL installed for security.
      - NavinF 4y ago
        Yeah but that's a lot less common these days: https://www.usenix.org/system/files/login/articles/login_dec14_02_ward.pdf https://www.usenix.org/system/files/login/articles/login_dec... I don't want LE to waste money supporting such use cases.
        bombcar 4y ago
        Ever since LE added wildcards it’s not as bad - get the cert on one machine, copy it via scripts to all.
  - bombcar 4y ago
    Is there a certbot client for ESXi?
- duskwuff 4y ago
  > Nobody offers more than a year now. Correct, because the CA/Browser Forum no longer permits CAs to issue certificates with validity longer than 13 months: https://pkic.org/2020/07/09/one-year-certs/ https://pkic.org/2020/07/09/one-year-certs/

bombcar 4y ago

Nobody offers more than a year now. It’s annoying. So many old devices still need to be supported and can’t automatically update.

NavinF 4y ago
If these devices have internet access they can auto renew. If they don't, they don't need a cert signed by a public CA.
- Cogito 4y ago
  I partly agree with you, however it's possible for devices to have limited access to the internet, or even no direct access but still be accessible to devices that are on the internet. If I have a smart device at home I may put it on a network that has no outgoing access to the internet, but it would still be nice to be able to connect to it with a web browser without getting angry expired certificate warnings. It's not the worst problem to have, and I don't think it's easy to fix, but it's still annoying.
  - progmetaldev 4y ago
    A company extranet locked by a whitelist of IP addresses comes to mind. You still want a SSL installed for security.
    - NavinF 4y ago
      Yeah but that's a lot less common these days: https://www.usenix.org/system/files/login/articles/login_dec14_02_ward.pdf https://www.usenix.org/system/files/login/articles/login_dec... I don't want LE to waste money supporting such use cases.
      - bombcar 4y ago
        Ever since LE added wildcards it’s not as bad - get the cert on one machine, copy it via scripts to all.
- bombcar 4y ago
  Is there a certbot client for ESXi?
duskwuff 4y ago
> Nobody offers more than a year now. Correct, because the CA/Browser Forum no longer permits CAs to issue certificates with validity longer than 13 months: https://pkic.org/2020/07/09/one-year-certs/ https://pkic.org/2020/07/09/one-year-certs/