Automated renewal with letsencrypt is a thing. Blaming this on the shutdown rather than on not taking appropriate care to do this more robustly? Meh.
Some of the sites listed use EV certificates, which aren't supported by Let's Encrypt.
And using Let's Encrypt for automated renewal comes with risks of its own. Note, for example, that very few of the "major sponsors" listed on the Let's Encrypt website use Let's Encrypt for their own sites.
Immensely curious how you came about this conclusion of all the possibilities available
Enterprise is inherently more risk averse than most parts of our industry, largely because they can put a dollar amount on outages.
It’s not like cert issues are a solved problem either, O2 (massive uk telecoms provider lost data access for 20 million customers because of cert issues a couple of months ago).
How long do you think the average company's IT infrastructure would continue working if all employees instantly dropped dead? With no one to respond to any issues that crop up, and nothing that isn't 100% automated happening at all?
Not experienced enough to have an answer
If you're doing it for free as a favor for a non-technical friend then yes, almost certainly you will need to do at least some maintenance work in the future.
It's easy to have services working unattended for a long time when someone else is responsible for maintaining the hardware; even better if they're maintaining the OS updates too.
Now if all the datacenter staff are furloughed too ... the first usually trivial issue might take everything down.
The biggest benefit of lets encrypt for companies is not the price. Having someone responsible for renewal, getting the bills through the billing system and approved, getting it installed. All those steps involve employees that could be spending their time on something more important. If any part of the chain fail there will also be a massive fallout which can be very costly. Automated renewal changes all this to a initial cost during construction of the service, usually during the per-production phase.
My concern would not be about the automated renewal if all employees instantly dropped dead. Sooner or later a service will hang, some resources exhausted, and things stop to work.
Same, it's magic. Works perfectly.
Only annoying part, UptimeRobot spits out some warnings, "Your certificate is set to expire soon..." but thanks to auto-renew I don't have to do anything about it.
One data point does not make a very useful statistic, and most definitely does not make a meaningful statistic for making decisions about production systems.
I personally find anecdotal information useful from people who work professionally on it when there is no other information available. I find the top comment in this thread interesting even if its just a single data point from a diesel engine mechanic.
Infra that I've built? Years. If that makes me above-average, I hope it's only barely.
Guess what :)
The reason a significant portion of the US government is shut down is because they literally have no money to spend because congress hasn't raised the debt ceiling to allow the government to borrow more money. So the 'spending limit' you mention would have been $0.00 the moment the shutdown happened.
Probably a better solution is to no longer run the government with a spending deficit.
The article mentions it is a thing in the following cases:
"""Any website that’s hosted on cloud.gov, search.gov or federalist.18f.gov won’t go down as they rely on Let’s Encrypt certificates that automatically renew every three months."""
As a contracting project, I imagine it would be pretty expensive to upgrade every single website of the US federal government to use Let's Encrypt. How many different operating systems and web server setups there must be?
What if the contract has a problem? It happens. What if the approving official is out sick for a month? It happens.
Not knowing how to set these things up? I don't really think that's an excuse. This should be addressed in the requirements.
Source: I've worked in and with the federal government for more than 25 years.
Automation doesn't matter if the spending isn't approved.
> because so many federal workers have been sent home on unpaid leave — or worse, working without pay but trying to fill in for most of their furloughed department — expired certificates aren’t getting renewed. Renewing certificates doesn’t take much time or effort — sometimes just a click of a mouse. But some do cost money, and during a government shutdown there isn’t any.
My personal guess is that the author of the article doesn't know which it is.