3 ms·

Its better than it was, but TLS has a lot more knobs to fail than even a basic http server does; theres a whole host of handoff thats happening and running mult

by dijit 2y ago

Its better than it was, but TLS has a lot more knobs to fail than even a basic http server does; theres a whole host of handoff thats happening and running multiple sites is fraught with minor issues. certbot is a python program, better hope it keeps working- it’s definitely not kept working for me and I’m a seasoned sysadmin. a combination of my python environment becoming outdated (making updates impossible) and a deprecation of a critical API needed for it to work. The #1 cause of issues with a hobby website: darkscience.net is that it refuses to negotiate on Chrome because the TLS suites are considered too old, yet in 2020 I was scoring A+ on Qualys SSL report. Its just time, time and effort and its wasted mostly. The letsencrypt tools are really wonderful, just pray they don’t break, and be ready to reinstall everything from scratch at some point.

usr1106 2y ago
> certbot is a python program, better hope it keeps working There is also https://github.com/srvrco/getssl https://github.com/srvrco/getssl which is a bash script. I have lightly audited it years ago and it did not seem to upload your private keys anywhere... I've used it occasionally, but I don't let it run as root, so I need to copy the retrieved certs into the the server config manually.
- dijit 2y ago
  Theres a bunch of alternative clients and I’ve tried many. Larger point is regarding the fact that its required for what amounts to a poster on a wall: yes, someone can come along with a pen an alter the poster- but its not worth the effort to secure for most people and will degrade rapidly with such security too. So, instead they turn to middlemen, or don’t bother. Theres a myriad of other issues, but, its not as easy as we claim.
ndsipa_pomu 2y ago
> certbot is a python program, better hope it keeps working- it’s definitely not kept working for me and I’m a seasoned sysadmin. a combination of my python environment becoming outdated (making updates impossible) and a deprecation of a critical API needed for it to work. You could try out acme.sh that's written purely in shell. It's extremely capable and supports DNS challenge and multiple providers https://github.com/acmesh-official/acme.sh https://github.com/acmesh-official/acme.sh
homebrewer 2y ago
Modern http servers (like caddy) do not make it any more difficult than setting up plain http (it's actually the opposite — you have to specify the schema — http:// http:// — in front of the domain name if you do not want https; otherwise you get https + 301 from http).

by dijit 2y ago

usr1106 2y ago

> certbot is a python program, better hope it keeps working There is also https://github.com/srvrco/getssl https://github.com/srvrco/getssl which is a bash script. I have lightly audited it years ago and it did not seem to upload your private keys anywhere... I've used it occasionally, but I don't let it run as root, so I need to copy the retrieved certs into the the server config manually.

dijit 2y ago
Theres a bunch of alternative clients and I’ve tried many. Larger point is regarding the fact that its required for what amounts to a poster on a wall: yes, someone can come along with a pen an alter the poster- but its not worth the effort to secure for most people and will degrade rapidly with such security too. So, instead they turn to middlemen, or don’t bother. Theres a myriad of other issues, but, its not as easy as we claim.

ndsipa_pomu 2y ago

> certbot is a python program, better hope it keeps working- it’s definitely not kept working for me and I’m a seasoned sysadmin. a combination of my python environment becoming outdated (making updates impossible) and a deprecation of a critical API needed for it to work. You could try out acme.sh that's written purely in shell. It's extremely capable and supports DNS challenge and multiple providers https://github.com/acmesh-official/acme.sh https://github.com/acmesh-official/acme.sh

homebrewer 2y ago

Modern http servers (like caddy) do not make it any more difficult than setting up plain http (it's actually the opposite — you have to specify the schema — http:// http:// — in front of the domain name if you do not want https; otherwise you get https + 301 from http).