Hacker News Reader

Comment by georgyo | Hacker News Reader

Mkcert and certbot are new utilities. OpenSSL predates them by decades.

Before acme, someone had to create a CSR manually, often using OpenSSL.

Also, should therw be a separate tool to debug and inspect ssl certs and connection? How many individual tools should there be?

View on HN

Perhaps it's worth mentioning XCA [1] at this point. It's a GUI based on openssl that provides an intuitive UI for managing keys, certs (root CA, intermediate CA, server and client) and CSR. It existed before acme and mkcert. What I liked in XCA was that it made it easy to review all parameters related to the operations it managed.

[1] https://hohnstaedt.de/xca/index.php

I continue to use it even today for small root stores I manage for internal networks. Very clean and intuitive UI that gets the job done well.

Also using Kleopatra for GPG keys.

+1 XCA. It is a fantastic way to manage your own root CA.

There should be lots of individual tools.

I have bad news for you: LetsEncrypt and ACME are almost 10 years old. Like the rest of us, you're getting old.

LetsEncrypt was founded 7 and started issuing certs about 6 years ago.

> There should be lots of individual tools.

Maybe there should be, but for many things that openssl can do (for example, testing and debugging a TLS connection, examining the contents of a certificate, creating a CSR to send to a non-ACME CA, converting between different formats of certificates, etc.) I'm not aware of good single-purpose tools.

> There should be lots of individual tools.

Arguably, OpenSSL is a collection of lots of individual tools. Each of the tabs in the "GUI" is an individual command with its own man-page, etc.

Each command still brings a lot of of options and therefore complexity with it, but that's because the domain is complex.

openssl is more than twice as old as that.

> Mkcert and certbot are new utilities. OpenSSL predates them by decades.

Certbot has been around for 7 years at this point, and is the same age as VS code. Frankly at this stage there's very little excise to not use it.

I use certbot to maintain valid certificates for my website, but there are more use cases for certificates than just https binding--and not all of them lend themselves to LetsEncrypt provisioning. The openssl CLI is definitely not simple, but in my experience it has often been the best available tool for various use cases.

You must use openssl to convert your useless certbot certificates and private keys into something that a Java program can actually use.

Reply on news.ycombinator.com