Hacker News Reader

Comment by wolf550e | Hacker News Reader

Can you describe the kind of person who hosts their own website but cannot easily set up Let's Encrypt automatic renewal?

View on HN

http://www.paulgraham.com/

There's no cert because there's no need for one in the first place. Mentioning that is pretty silly - it's obvious that there's nothing wrong with a static site with now cert, and no one is arguing against that.

> there's nothing wrong with a static site with no cert

Not really. Google says "switch to HTTPS or lose ranking":

https://webmasters.googleblog.com/2014/08/https-as-ranking-s...

Good to note. But I think you're distracting from the article's talking point.

I disagree with "switch to HTTPS or lose ranking", but that's an HTTP vs. HTTPS issue with Google's search ranking, not about Chromium or Mozilla. This article is about Chromium & Mozilla making stricter rules for HTTPS certificates. That's not a bad thing, to hold HTTPS sites to a better standard.

> no need for one in the first place ... it's obvious that there's nothing wrong with a static site with no cert

Oh yes, there is.

https://doesmysiteneedhttps.com

> YES

> Your site needs HTTPS.

The whole "Let's Encrypt should solve all your problems" attitude is arrogant and short-sighted.

1) In my experience the user experience even for technical admins is still flakey on at least some popular platforms. In other words, it's not as incredible as you think.

2) It's not available to a host that doesn't connect to the internet but does occasionally get connected to by a local browser (eg. IoT firewalled inside my LAN is one obvious such case; I'm sure there are others).

And most importantly:

3) You'd have to be insane or naive to accept an architecture that leaves you dependant on a single vendor (especially if you need that vendor more than they need you!).

How fortunate, then, that LE isn't the only vendor. Not even the only ACME vendor, nor the only free vendor (https://zerossl.com/features/acme/).

If your device never connects to the internet then how would any public cert work? It would expire like any other?

Me. I use shared hosting on a server that runs a reverse nginx proxy to my nginx server. I don't have root on the server. I have a LE cert that I need to manually fiddle with DNS settings every 3 months to get. If you know how to automate it I'd love to hear about it.

Why doesn't their nginx proxy /.well-known/ requests for your domain to your nginx? Then you could just use `certbot certonly --webroot --webroot-path /path/to/webroot/for/your/domain -d your.domain.name -d www.your.domain.name` once and put `certbot renew` and nginx reload in crontab weekly, and you're good to go.

If you can't use HTTP-01 and must use DNS-01 challenge, I would check whether the software that runs your host's DNS management panel has an API in addition to manual mode. If not, I would check for ability to automate HTTP requests to that tool (parse the HTML, submit the forms, basically). My hope would be that the tool is popular and someone already did the work and code exists to operate it as if it had an API.

If you can do that, you can write (or find one already written) a certbot plugin that performs the DNS challenge using your credentials to the host provided DNS settings. certbot has number of plugins for the big hosting providers: https://github.com/certbot/certbot

certbot is the most popular Let's Encrypt client, but it's not the only one. Maybe another client has support for your situation. I would maybe ask the support of your hosting provider, maybe they know something.

Letsencrypt is broken or an incredible pain in so many different setups its not even funny.

What are setups where it’s broken? Sincerely.

If you can’t accept inbound http traffic then you use DNS verification and if you never contact the internet then no public cert could work for you.

Devices with web based interface (KVM over IP, IPMI, etc).

iDRAC has a CLI tool that can be instrumented to install new certs regularly. I’m sure other vendors do as well.

That's me! I'm technical enough to self-sign for ssl for my sites (it and tor are what I do instead) but I run on lots of old hardware and old (>5 years) OSes. The tools for constantly re-updating letsencrypt simply don't work and all the containerizations didn't exist yet. I've tried nearly a dozen LetsEncrypt updates solutions, compiled from source, from debs, "standalone" only bash solutions, etc, there's always a catch that prevents it from working.

Are those >5 year OSes receiving security patches?

They probably receive more security patches than Centos 8 and by that I mean Centos 8 is lagging behind.

Shared hosting

Unless they set up LtE for their customers

(And as much as I like LtE I think it's complicate to depend in one issuer only)

Semaphor asks "can you describe the kind of person". Since when is "shared hosting" a person?

People who know how to set up a website on a shared hosting platform probably also know how to renew a LE certificate, I think.

Lots of people. Such arrogance from those who post on hackernews.

Reply on news.ycombinator.com