Hacker News Reader

Comment by brazzy | Hacker News Reader

In case anyone is left wondering amout what specifically has changed and whether they might also have problems manifest suddenly:

https://letsencrypt.org/docs/acme-protocol-updates/

https://community.letsencrypt.org/t/end-of-life-plan-for-acm...

So this has been planned for quite some time, and if you have a current Letsencrypt client, it should keep working seamlessly.

But yeah, if you have servers running an old OS release that won't get a new certbot version, that's gonna suck.

View on HN

Why force people to upgrade if it isn't necessary? Was there a huge price on the side of LE to keep the old protocol up and running until it was no longer in use? Is that price balanced out by the combined cost of the users having to upgrade their systems, something that typically costs a day or more per installation?

Reading between the lines, it seems the v1 protocol was basically a proof of concept implementation and differs in some points from the final RFC specification.

With Letsencrypt being by far the most popular ACME provider, if they kept running the old version even optionally, there would be very little incentive for clients to start supporting the standard instead of the POC.

I can understand how they don't want to be the IE6 of CAs.

Unless there was an incurable security issue in the V1 protocol I see no reason to force an upgrade on the part of untold millions of installations.

From the linked article above

> In November of 2019 we will stop allowing new account registrations through our ACMEv1 API endpoint. _Existing accounts will continue to function normally._

Except that a new domain counts as a new account.

That is not true. In fact you have an account key that identifies you and the account. With that account you can create and update the certificates of many domains.

Well, that's an implementation detail for Mailinabox, which I do not have sufficient insight in but as far as I know all the domains on that machine share the same account key, and an attempt to manually update one of these gave the exact same error as the mailinabox UI. So either miab uses one account per domain (which is very well possible, but that detail is not exposed) or something else is wrong.

Reply on news.ycombinator.com