2 ms·

You're rephrasing your claim, not providing any argument. If renewal is automated correctly, why would it bring more maintenance? When is automation not helpful

by remram 3y ago

You're rephrasing your claim, not providing any argument. If renewal is automated correctly, why would it bring more maintenance? When is automation not helpful? If my automation is broken, I would rather find out sooner than later... or having to find out the previous guy set it up wrong. Wouldn't you?

JohnFen 3y ago
My claim is that I have situations where automation is not feasible to implement, not that I have trouble correctly setting it up. People are downvoting my comments here, no surprise, so I feel compelled to clarify: I am not saying that others shouldn't use LE, nor am I saying that LE is without value. I am acknowledging that LE is not a panacea and brings its own complications that have to be considered. In my case, LE is not a solution that works for me. Instead, I buy the certs for my websites that are used by the general public, and run my own private CA with my own root cert that is used to mint certs for everything else.
- remram 3y ago
  I would love to hear more about your issue though. I have deployed LE in situations where I needed wildcard certs and didn't have access to the DNS server to set the challenge (literally a separate network) successfully. I have deployed it in situations where the DNS server doesn't even have an API at all. I won't claim that it is always easy, but I really can't object to the short lifetime. I agree that the goal should be to automate this. After all, domain registrations aren't forever, you shouldn't be able to hold on to certificates to someone else's domain.
  - JohnFen 3y ago
    I'm certainly not saying I have a situation where it's impossible to do automation. Just that it's sometimes not feasible, in that it takes too much effort and introduces more points of potential failure. In other words, that it's more complex than just buying a cert with a longer lifetime and using that. In my case, it's not a DNS issue but one of the systems themselves not having enough available resources to put the automation on, which means that I'd have to do the automation on another machine and either set up some sort of automated method of moving the certs to their ultimate destination or manually install them. > domain registrations aren't forever Technically true, but practically? The youngest domain name I have, I've had for over a decade. Most of my domain names are much older. They are, for all intents and purposes, permanent.

by remram 3y ago

JohnFen 3y ago

My claim is that I have situations where automation is not feasible to implement, not that I have trouble correctly setting it up. People are downvoting my comments here, no surprise, so I feel compelled to clarify: I am not saying that others shouldn't use LE, nor am I saying that LE is without value. I am acknowledging that LE is not a panacea and brings its own complications that have to be considered. In my case, LE is not a solution that works for me. Instead, I buy the certs for my websites that are used by the general public, and run my own private CA with my own root cert that is used to mint certs for everything else.

remram 3y ago
I would love to hear more about your issue though. I have deployed LE in situations where I needed wildcard certs and didn't have access to the DNS server to set the challenge (literally a separate network) successfully. I have deployed it in situations where the DNS server doesn't even have an API at all. I won't claim that it is always easy, but I really can't object to the short lifetime. I agree that the goal should be to automate this. After all, domain registrations aren't forever, you shouldn't be able to hold on to certificates to someone else's domain.
- JohnFen 3y ago
  I'm certainly not saying I have a situation where it's impossible to do automation. Just that it's sometimes not feasible, in that it takes too much effort and introduces more points of potential failure. In other words, that it's more complex than just buying a cert with a longer lifetime and using that. In my case, it's not a DNS issue but one of the systems themselves not having enough available resources to put the automation on, which means that I'd have to do the automation on another machine and either set up some sort of automated method of moving the certs to their ultimate destination or manually install them. > domain registrations aren't forever Technically true, but practically? The youngest domain name I have, I've had for over a decade. Most of my domain names are much older. They are, for all intents and purposes, permanent.