Hacker News Reader

Comment by cm2187 | Hacker News Reader

Well Let's Encrypt has a solution, it is DNS authentication, which doesn't require Let's Encrypt to establish a direct connection to the device. But you still need a way to automatically renew the certificate (your DNS must have a supported API) and deploy it automatically. But that's not a Let's Encrypt problem to solve.

View on HN

I use this solution myself.

I have a domain name I own and only have A records configured for use on internal DNS.

Externally it is managed by cloudflare, and certbot uses the cloudflare plugin to renew certificates before deploying certs to my hardware over telnet

How I read this comment, presented as an audio-playback-style progress bar:

  [--------------------------------------------??]
     ^ Interesting!   ^ Huh, that's a good i-- ^ Wait, what?

Deploying via telnet is reality for a lot of kit

> But that's not a Let's Encrypt problem to solve.

But it's a problem they permitted to arise by enforcing 90-day expiry

An internal web config interface could happily use a 10-year cert

Browsers are also enforcing this, so again not really a let’s encrypt problem.

But create your own root certs. That’s a much better route if you want to never update your certs on the device.

Do browsers allow > 13 month validity for certs from private CAs?

Either way I’d rather not trust my own CA as I’m not capable of keeping such a powerful tool secure.

For private CAs you can do whatever you want. It is only for public CAs that browser enforce short certificate expiries.

Reply on news.ycombinator.com