Hacker News Reader

Comment by byuu | Hacker News Reader

I buy them. I don't like paying for them, but I want a certificate I know will just work for years without having to run certbot or one of its clones on my server. Well, that and LE didn't yet allow wildcard certs when I bought mine. They've already dropped their maximum validity from three to two years though, so I'll probably throw in the towel when they further reduce their validity to less than six months.

View on HN

Let's Encrypt certs are valid for 90 days.

There are 2 reasons: 1. To limit damage from key compromise and mis-issuance 2. To encourage automation.

What is the issue with running the certbot on your server? It's not like you have to run it manually.

Here are official reasons: https://letsencrypt.org/2015/11/09/why-90-days.html

P.S. Wildcard certs are available for almost a year now: https://community.letsencrypt.org/t/acme-v2-production-envir...

The issue might be executing 3rd party code on a server.

ACME is an open protocol (and very soon it will be an IETF Internet Standard too). There are many alternative implementations. Just find one you trust. We actually did our own DNS-based implementation for our infrastructure.

I don't want to run someone else's code on my server just for this (the default certbot wants root access too, yikes), nor do I want to analyze someone else's implementation before running their code, and I sure as heck don't have the time, patience, or interest to write my own implementation of ACME just for the one service that uses it.

I want to go to a website, have it tell me to put a string into a meta tag or DNS TXT record, and then save the key it returns on my box. Then I want to forget about it for the next 2-3 years.

Honestly I don't even want to do that. I want my nameserver to generate a DANE/DNSSEC record for me automatically, and for browsers to honor that. It isn't like domain verification is any more secure than a DNSSEC record would be.

Take a look at https://github.com/joohoi/acme-dns/ (which of course still requires trust in the client lib)

We do something similar, although not through a REST API. We handle all this cert management centralized on one server, which publishes the DNS records for DNS verification etc.

On our other servers is then just a simple script that periodically checks if the certs on the machine are near the expiry date and if so pulls a new one from the central system.

ACME protocol is fairly straight forward to implement, and you can easily write your own implementation with existing code (OpenSSL, Apache/nginx, etc).

With many commercial registrar's, although they offer a valid and long certificate, their technical aspects aren't very good. Many CAs don't support ECC certificates, the must-staple flag or CT SCTs embedded in the certificate.

I work a lot with web PKI, and every time I have to deal with a CA that's not LE or Digicert, I sigh out loud.

Well that's nice. But that mean you'll have to manually buy, upgrade install and test them. I have better things to do.

Takes about 5 minutes of time. It really isn't a big deal.

So does setting up Let's Encrypt + automating the renewal, and you don't have to spend a dollar in those 5 minutes.

5 minutes once forever is even less of a big deal.

A certificate that last for years... That's exactly how you end up with a certificate that expired and no one realized. An automated process is a way more reliable.

Until the automated process breaks. I've encountered more "invalid certificate" warnings on Let's Encrypt sites than any others.

Reply on news.ycombinator.com