Hacker News Reader

Comment by victor9000 | Hacker News Reader

I recently replaced an expired cert with one from LE and the entire process was super simple. Their cli automatically handles all the tedious steps like creating the signed request, proving server ownership, and creating the certificate bundle. What's more, it also provides tools for renewing certs in an automated way. I really can't see myself using anything else from here on out.

View on HN

Last time I checked the LE cli tool required root access to my machine. Totally annoying and unnecessary.

Otherwise, I applaud the initiative.

There are alternative clients one can use like acme_tiny.

How does this meme keep getting repeated over and over and over when it was wrong the day LE launched? It doesn't even make sense if you just think about it. Why would you need root access to make some HTTP calls? Most ACME clients don't require root. The one-click-and-reconfigure-my-webserver obviously requires root.

Certbot defaults to a path on your system that requires root, and sets permissions so non-root users can't look at your private keys.

If you would like to use it without root/sudo, you can pass flags changing the directory it uses. For example:

    certbot --logs-dir ~/SSL --work-dir ~/SSL --config-dir ~/SSL

Reply on news.ycombinator.com