Hacker News Reader

Comment by specialist | Hacker News Reader

Just today, I'm setting up my first https by myself.

Started with Let's Encrypt. Running Mac OS X. Failed. Guessed cause has something to do with macports vs homebrew and having the proper Python version active. Disabled macports. Now the app runs.

But I got "Failed to connect to host for DVSNI challenge".

Start googling, reading, messing around with this for a while. No joy.

Bailed on Let's Encrypt, started over with StartSSL, because its the first source of free for not-for-profit certs I found.

Happy to take recommendations for alternatives.

View on HN

My recommendation is to look beyond the free alternatives and consider how inexpensive paid certificates have become. These can be issued for lengths up to three full years and cost well under $10USD/year. Multi-year discounts bring three year certificates price to under $20USD.

Think about how much time it is going to take you to learn how to deploy and maintain your 'free' certificates and remember time is money. What do you make an hour? Is that more than the cost of a paid certificate?

I have used these certificates - https://cheapsslsecurity.com/comodo/positivessl.html - on multiple sites and it is very fast and easy. Other vendors sell them too and are likely just as good. Gandi do them too (at a slightly higher cost) and are the fastest method for me, though this may be because I have all my domains there already: https://www.gandi.net/ssl/standard?currency=USD#single

Don't waste hours chasing down free certificates when paid ones are so cheap now. Use Let's Encrypt only if you need lots of certificates and the paid options become prohibitively high.

I just made a new certificate at StartSSL. Took me about ten minutes to create it and implement it on the server.

I'll use Let's Encrypt when they have a easy setup available.

I found https://github.com/lukas2511/letsencrypt.sh to be quite nice and easy.

Are paid certificates actually easier to set up? I don't see why that would be.

The official Let's Encrypt client is bloated and wants to fiddle with your HTTP server configuration. Bad idea.

Use something small like https://github.com/kuba/simp_le or https://github.com/diafygi/acme-tiny

I use acme-tiny and confirm it is good. But there is still significant work to do to get a working certificate and the documentation is lacking significant details. I have my own recipe documentation that I should publish. Apart from this, this is the only script out there that did cut it for me.

Note that the update process needs to be automated because let's encrypt certificates last only 3 months as I have read.

have you tried using something like https://gethttpsforfree.com/ as a front-end to the Lets encrypt process?

Reply on news.ycombinator.com