Hacker News Reader

Free is great. My only issue with LetsEncrypt is that the certificates are only valid for 3 months. It's a hassle to keep updating the certs...

I just switched to AWS Cert Manager last month from StartSSL, which is free if you're an AWS customer.

View on HN

3 months expiry time was a deliberate choice to force users to automate the process. Ideally you would have a central store with a letsencrypt client, and all your actual web servers periodically fetch their certs from there.

That's great except the web server (except apache/nginx) needs to be restarted to load new certs, which isn't ideal for production. Many cloud hosting providers don't have an automated way to update certs, which makes it more tedious.

Both apache and nginx support graceful reloads which will reload the certificates without any downtime.

Reply on news.ycombinator.com