Hacker News Reader

Comment by jiggawatts | Hacker News Reader

Something I would like the community do is force vendors such as Azure and AWS to support the ACME protocol to provide the option of free certificates to users. HTTPS isn't an add-on any more, and it shouldn't come with a yearly tax.

Unfortunately, a yearly tax has a margin, so the vendors have been dragging their feet. DigiCert and GoDaddy have bribed the Azure team with kickbacks and wholesale discounts, so Azure is now refusing to implement anything else. Why would they? They get a margin on every issued certificate!

So please: If you have a presence in AWS or Azure, call your sales representative and pressure them. Submit requests through the feedback portal, and vote up existing requests.

Raise this regularly, or it will never happen by itself. The incentives just aren't there!

Pressure must be applied by a large fraction of the customers.

You are that customer.

Apply pressure.

View on HN

AWS provides already free certificates. It doesn’t use ACME but also AWS ACM supports auto renewal if the host name has been dns validated.

Initially these certificates were only supported for load balancer and cloud front but with the Secure Enclave you can use the certificate also on an ec2 instance.

While on GCP, you can self-host cert-manager and its certificates can be used at Load Balancers and VMs.

FWIW, Azure has started rolling out free certificates for App Service - they have some kinda annoying limitations, but it's a start and some of them are planned to be lifted: https://docs.microsoft.com/en-us/azure/app-service/configure...

By "kinda annoying" you mean ludicrous and show-stopping, right?

    Does not support wildcard certificates.
    Does not support naked domains.
    Is not exportable.
    Is not supported on App Service Environment (ASE)
    Does not support A records. For example, automatic renewal doesn't work with A records.

There's probably at least several other restrictions not listed there. I recently tried to buy a certificate for App Service for a government agency, but it was refused because of a design flaw in GoDaddy's validation code.

Not to mention that this doesn't cover other very common scenarios, such as Application Gateway, VM scale sets, API Gateway, or... anything else.

Each Azure team seems to be operating under the model that HTTPS with a custom domain is some sort of bolt-on that's unique and special to their service. The verification and enrolment is distinct for every service, with gaps and weird and wonderful limitations.

It's like they've been told, recently, that HTTPS is something they should do, so they've all gone and done "something" to tick that checkbox. Some free. Some not free. Some with restrictions. Some without. Some automatically renewing. Some not. Some with ECC, some without. HSTS on some, not others. Etc...

It's a shit show.

it's Azure, what can I say ¯\_(ツ)_/¯

If you wanted to save money, you wouldn't use Azure or AWS anyways.

What would you use then?

Linode, DigitalOcean, or a $200 used server from EBay. Both Linode and DO also have really good Kubernetes services. AWS and alike force users to stick to their ecosystem of products, and come with all sorts of weird pricing models. And if you really need some sort of serverless features or BaaS, you can just self-host that on a VPS.

Binary lane for Australia is fantastic.

Echo this. great pricepoint, I'm on a BSD box and their console/backend has been flawless. And, its full dualstack v4/v6

Which reputable vendors would you recommend that have a full PaaS offering for ASP.NET and have a significant presence in Australia?

As far as I know Azure's App Service has no direct competition other than AWS and GCP.

Reply on news.ycombinator.com