How Etsy Manages HTTPS and SSL Certificates for Custom Domains on Pattern

I'd like to thank Etsy for writing this article. Let's Encrypt's availability makes large deployments easier, but they're still not actually all that easy to pull off in many cases. It takes a lot of thought and work to scale securely.

We at Let's Encrypt talk to a lot of large providers about large deployments and there's really nothing more helpful than being able to refer engineering teams to detailed accounts of previous efforts.

These writeups really make a difference because they accelerate other large deployments. The sooner those other large deployments happen, the sooner many more people will experience a more secure and privacy-respecting Web.

I've googled this subject a number of times over the years and this seems to be the most thorough answer. Thanks for providing it!

However, for a small startup (like mine), I think it's still a bit too much work to get this working. I know that there aren't any other "automated" options out there anyway. Perhaps one day. :)

>To connect all this together, our proxy hosts periodically query CertService for a list of recently modified custom domains. Each host then 1) fetches the new certificates from CertService, 2) writes them to disk, 3) regenerates a config like the one above, and 4) does a graceful restart of Apache. These restarts are staggered across our proxy pool so all but one of the hosts is available and receiving requests from the load balancer at any give time (fingers crossed).

How many pools are there? If you're having to restart apache every time you renew a cert, are they renewing certs in the background and then only restart apache when they have around a thousand renewed? If so, wouldn't the current running certs be revoked in that time? It seems like on-the-fly cert usage is something that could be made, if not already.

Was just talking with my boss a few weeks ago regarding how we might allow customers to use a custom domain name in the future. Was dreading that implementation but now it's looking a little brighter with this writeup. Thanks Etsy!

It's a good article, but it's a bit light on some of the technical points. We tried doing something similar about a decade ago (before the widespread adoption of SNI) and ran into the classic connected name/host header mismatch problem. Here, it's not explained that client has to have a way to suggest which certificate it's going to validate, and that there wasn't always an answer for that problem.

Also curious to know more about their LB solution and how it scales. Encrypting everything isn't free if you're doing thousands of ECDH[E] handshakes per second to chase down that "A+" rating.

Is't only me, or their initial reasoning ('it's pricey' and a screeenshot of a certificate being $1500+ when you can have it for less than $10) moves the focus of why Let's Encrypt it important - not that it's free, but that the ACME protocol gives you the freedom to generate certificates very easy, and have that setup process even easier for multiple (think all) services flawless.

Congrats for them for supporting Let's Encrypt as an organization (it's not mentioned in the article it is in the comments here).

Where's the part where they donate to Let's Encrypt as a thank-you for making all this possible?