Hacker News Reader

Comment by onion-soup | Hacker News Reader

Because it's always pain in the ass to set it up and then renew?

How exactly is it a pain in the ass?

- If you are hosting a simple static page or blog, your hosting provider probably has Let's Encrypt plugin.

- If you have your own VPS, Caddy has you covered with file serving, fastcgi support for PHP, and proxying to (g)unicorn/nodejs/Go/.NET, and has HTTPS enabled by default.

- If you have more advanced setup (e.g. containers), traefik supports HTTPS with just a few lines of configuration.

- If you are big enough to afford cloud, it takes a few lines of Terraform code to provision certificate for load balancers (speaking for AWS, and assuming others have similar solutions).

For other cases (e.g. lots of traffic with custom haproxy/nginx/etc. setup), you are probably smart enough to find out how to enable Let's Encrypt support.

1) Not everything is running bare Apache. In fact, some services might have some rather strange web-driven GUI (or, more interestingly, curses-like) that requires you to carefully load a certificate, a CSR, and so forth in a somewhat arcane manner. Some pretty niche serving exists out there and I have had to deal with a bunch of them, to the point where I had to write extensive documentation on keeping the certificates up to date on each separate weird service. Many of these services have a "no user-servicable parts inside, your warranty will be voided ..." clauses in the service contract which deter spelunking.

2) Some services require wildcards, like proxies.

3) Some organizations have, due to someone far away making strange decisions, policies about certificate authorities, and people to audit for compliance. Therefore, a cert costs money and, for a site which is purely informational, that's a hard sell.

4) Because we're not running on a hosting provider, a VPS, containers, or cloud.

5) Because not everyone wants to deal with some combination of the above every three months due to Let's Encrypt's expiration policy.

I generally run apache/nginx in front of most things for SSL termination — this allows you to simplify SSL setup significantly.

Set up once and then a cron-task? [0] It doesn't have to be a pain. The tooling around this all exists.

It's very very nearly maintenance free [1].

[0] There's lots of tooling. My current preference is for https://github.com/lukas2511/dehydrated

[1] If something breaks you have to pay attention, otherwise... Not so much.

I have found that Let's Encrypt certbot makes it really simple to set up HTTPS and renew the certificate for simple websites. Examples for Nginx:

- Setup: https://github.com/susam/susam.in/blob/master/Makefile#L30-L...

- Renewal: https://github.com/susam/susam.in/blob/master/etc/crontab#L1

Reply on news.ycombinator.com