6 ms·

I'm sure some people would find this useful but forgive me if I'm not ready to hand away my security to some unknown third party company. I don't know the first

by xmprt 1y ago

I'm sure some people would find this useful but forgive me if I'm not ready to hand away my security to some unknown third party company. I don't know the first thing about CAs but Let's Encrypt really isn't that difficult to understand.

geemus 1y ago
We take security very seriously, which is why we designed Relay to work so that we never have to see your encryption keys. If Let's Encrypt is working well enough for you, that's great, but we've also heard about rough edges that people struggle with so we are trying to help them out.
michaelt 1y ago
I believe the intent here is: * If you want an SSL certificate for, say, your printer * And you don’t want to expose your printer’s port 80 to the public internet because you’re not stupid * And you don’t want to put your DNS credentials onto your printer either, because again, you’re not stupid * And you don’t want to pay for a certificate with a longer validity, because it’s a home printer, so you’re stitch with monthly cert rotations * And you’ve embraced the reality that one can delegate SSL not just to CAs, but also to other third parties. Usually the likes of AWS & cloudflare - but why stop there? Then this product is what you need!
- eternauta3k 1y ago
  Why not sign it yourself?
  - woodruffw 1y ago
    Most people find the user experience of self-signed certificates much worse. The developer experience for local issuance isn't great, although mkcert does a really great job of smoothing the parts that can be smoothed[1]. [1]: https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert
    - xp84 1y ago
      I started but haven't yet completed a project to use mkcert on a home server, and get all devices in the house to trust it as a CA for things such as printers and "internal tools" for my family such as Jellyfin, etc. This would probably be easier if I was organized enough to use at least minimal MDM features on the family's devices though, so I haven't actually completed this project yet.
- toast0 1y ago
  > * If you want an SSL certificate for, say, your printer Ummmm why does my printer need a certificate?
  - mholt 1y ago
    If you can't trust your network, you'll want encryption, regardless of devices on it.
    - Palomides 1y ago
      if you can't trust your network, everything needs to be public internet level hardened anyway, so why not just directly use letsencrypt?
      - Hackbraten 1y ago
        Because you don't want to expose your printer to the public Internet?
        fxtentacle 1y ago
        Then you need to make your network trustworthy first.
        Hackbraten 1y ago
        Why?
        fuckinpuppers 1y ago
        Isn’t that what dns challenge can be used for?
  - michaelt 1y ago
    Well yes, you've just hit on why this is a rather niche product. You get a handful of somewhat questionable benefits. If for some reason your guests are visiting your printer's administration page, they won't have to click through a scary warning page. If someone is somehow sniffing all the traffic within your home network they won't be able to get your printer's administrative password. But the main reason is some homelab enthusiasts are like bodybuilders at the gym - taking on tasks that seem Sisyphean to outsiders, for fun and to build their strength.
- unsnap_biceps 1y ago
  Are there any printers that actually run acme where this is even a consideration?
- weddpros 1y ago
  I think it's more a matter of scale. If you need SSL certificates for hundreds of appliances and you want to manage it, rather than hack it, that's the product you need.
weddpros 1y ago
There's a scale beyond which the real challenge isn't issuing a certificate. I see organisations with thousands of SSL certificates, and their struggle is real. Even reputable companies with huge teams have their certificates expire or served badly. Some serve expired certificates for years! Plus, enterprise alternatives are extremely costly and rigid.
- tenuousemphasis 1y ago
  All the more reason to automate renewing of certificates.
  - weddpros 1y ago
    Sure! yet automation only solves one problem (until it doesn't). Inventory and control/accountability is still needed at scale, and automation doesn't provide it.

by xmprt 1y ago

geemus 1y ago

We take security very seriously, which is why we designed Relay to work so that we never have to see your encryption keys. If Let's Encrypt is working well enough for you, that's great, but we've also heard about rough edges that people struggle with so we are trying to help them out.

michaelt 1y ago

I believe the intent here is: * If you want an SSL certificate for, say, your printer * And you don’t want to expose your printer’s port 80 to the public internet because you’re not stupid * And you don’t want to put your DNS credentials onto your printer either, because again, you’re not stupid * And you don’t want to pay for a certificate with a longer validity, because it’s a home printer, so you’re stitch with monthly cert rotations * And you’ve embraced the reality that one can delegate SSL not just to CAs, but also to other third parties. Usually the likes of AWS & cloudflare - but why stop there? Then this product is what you need!

eternauta3k 1y ago
Why not sign it yourself?
- woodruffw 1y ago
  Most people find the user experience of self-signed certificates much worse. The developer experience for local issuance isn't great, although mkcert does a really great job of smoothing the parts that can be smoothed[1]. [1]: https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert
  - xp84 1y ago
    I started but haven't yet completed a project to use mkcert on a home server, and get all devices in the house to trust it as a CA for things such as printers and "internal tools" for my family such as Jellyfin, etc. This would probably be easier if I was organized enough to use at least minimal MDM features on the family's devices though, so I haven't actually completed this project yet.
toast0 1y ago
> * If you want an SSL certificate for, say, your printer Ummmm why does my printer need a certificate?
- mholt 1y ago
  If you can't trust your network, you'll want encryption, regardless of devices on it.
  - Palomides 1y ago
    if you can't trust your network, everything needs to be public internet level hardened anyway, so why not just directly use letsencrypt?
    - Hackbraten 1y ago
      Because you don't want to expose your printer to the public Internet?
      - fxtentacle 1y ago
        Then you need to make your network trustworthy first.
        Hackbraten 1y ago
        Why?
      - fuckinpuppers 1y ago
        Isn’t that what dns challenge can be used for?
- michaelt 1y ago
  Well yes, you've just hit on why this is a rather niche product. You get a handful of somewhat questionable benefits. If for some reason your guests are visiting your printer's administration page, they won't have to click through a scary warning page. If someone is somehow sniffing all the traffic within your home network they won't be able to get your printer's administrative password. But the main reason is some homelab enthusiasts are like bodybuilders at the gym - taking on tasks that seem Sisyphean to outsiders, for fun and to build their strength.
unsnap_biceps 1y ago
Are there any printers that actually run acme where this is even a consideration?
weddpros 1y ago
I think it's more a matter of scale. If you need SSL certificates for hundreds of appliances and you want to manage it, rather than hack it, that's the product you need.

weddpros 1y ago

There's a scale beyond which the real challenge isn't issuing a certificate. I see organisations with thousands of SSL certificates, and their struggle is real. Even reputable companies with huge teams have their certificates expire or served badly. Some serve expired certificates for years! Plus, enterprise alternatives are extremely costly and rigid.

tenuousemphasis 1y ago
All the more reason to automate renewing of certificates.
- weddpros 1y ago
  Sure! yet automation only solves one problem (until it doesn't). Inventory and control/accountability is still needed at scale, and automation doesn't provide it.