What are you talking about?
A clever design aspect of Let’s Encrypt is the deliberately short expiry. That forces administrators to automate the issuance and renewal process.
Not to mention that you’re not supposed to “download” the private key!
The whole idea of PKI is to generate the private key locally and then have a CA sign only the public part.
If you’re doing anything else you’ve undermined the entire purpose of the thing.
I mean you are literally -- not figuratively -- handing your secrets over to Russian hackers and complaining about the people politely showing you how to make your systems safe.
Learn about the ACME protocol and certificate automation: https://letsencrypt.org/docs/client-options/
> generate key online, provide me this service with sane implementation on a safe website
Well there's your problem right there. Either go on youtube and watch some videos about how TLS works or just use an http server like Caddy that automatically generates TLS certs and renews them with Let's Encrypt.
Correct, because the CA/Browser Forum no longer permits CAs to issue certificates with validity longer than 13 months:
If I have a smart device at home I may put it on a network that has no outgoing access to the internet, but it would still be nice to be able to connect to it with a web browser without getting angry expired certificate warnings.
It's not the worst problem to have, and I don't think it's easy to fix, but it's still annoying.
I don't want LE to waste money supporting such use cases.
The only way they can serve users is by forcing them to do the right thing.
You're insisting on doing the wrong thing and shouting at the people that are telling you how to do it right.
An analogy would be the equivalent of "not your wallet, not your crypto". Literally millions of naive crypto enthusiasts have just had $9B stolen from them by FTX because they didn't grasp this basic concept. They just wanted something convenient.
With something like PKI or cryptocoins, there are no shortcuts to security.
It's like sticky-taping your key to your locked front door.
Or writing your pin code on your credit card.
Or setting your password to "12345".
If you do not like the process LetsEncrypt uses, then you are not in their target market. That's fine; move on and use something else.
> I remember chinese websites issuing 3-year certificates. Wosign or something like that. That was the best experience I've ever had.
I remember Wosign! Man, what a terrible experience. The last thing I want is be forced to do system administration tasks manually by clicking around on a website. To be fair, it was great that it was available for its time, but I would never want to go back to something like that.
What is shady ?
It's literally a director's job to focus on more than one specific thing.