Hacker News Reader

Comment by jiggawatts | Hacker News Reader

> some shady websites

What are you talking about?

A clever design aspect of Let’s Encrypt is the deliberately short expiry. That forces administrators to automate the issuance and renewal process.

Not to mention that you’re not supposed to “download” the private key!

The whole idea of PKI is to generate the private key locally and then have a CA sign only the public part.

If you’re doing anything else you’ve undermined the entire purpose of the thing.

I mean you are literally -- not figuratively -- handing your secrets over to Russian hackers and complaining about the people politely showing you how to make your systems safe.

Learn about the ACME protocol and certificate automation: https://letsencrypt.org/docs/client-options/

View on HN

I know better what am I supposed to do. Type "download letsencrypt certificate online" in the Google and you'll find out what I'm talking about. You can think of forcing administrators all the day while Internet is full of expired letsencrypt websites that I regularly stumble upon. The world does not work like that. Letsencrypt should serve its users, not force them onto anything. If I think that I should generate key online, provide me this service with sane implementation on a safe website. If you won't, I'll download it from the "Russian hackers". ACME is awesome, but it's not always suitable, sometimes I want to get certificate manually and that's OK. I remember chinese websites issuing 3-year certificates. Wosign or something like that. That was the best experience I've ever had.

If people want longer certificate lifespans, they can get their certificates elsewhere. Part of the deal with getting a free certificate is that you're supposed to set up autorenewal with ACME. If you can't or don't want to do that, there are plenty of other CAs out there that will get you a long-life certificate.

Nobody offers more than a year now. It’s annoying. So many old devices still need to be supported and can’t automatically update.

If these devices have internet access they can auto renew. If they don't, they don't need a cert signed by a public CA.

I partly agree with you, however it's possible for devices to have limited access to the internet, or even no direct access but still be accessible to devices that are on the internet.

If I have a smart device at home I may put it on a network that has no outgoing access to the internet, but it would still be nice to be able to connect to it with a web browser without getting angry expired certificate warnings.

It's not the worst problem to have, and I don't think it's easy to fix, but it's still annoying.

A company extranet locked by a whitelist of IP addresses comes to mind. You still want a SSL installed for security.

Yeah but that's a lot less common these days: https://www.usenix.org/system/files/login/articles/login_dec...

I don't want LE to waste money supporting such use cases.

Ever since LE added wildcards it’s not as bad - get the cert on one machine, copy it via scripts to all.

Is there a certbot client for ESXi?

> Nobody offers more than a year now.

Correct, because the CA/Browser Forum no longer permits CAs to issue certificates with validity longer than 13 months:

https://pkic.org/2020/07/09/one-year-certs/

> Type "download letsencrypt certificate online" in the Google

> generate key online, provide me this service with sane implementation on a safe website

Well there's your problem right there. Either go on youtube and watch some videos about how TLS works or just use an http server like Caddy that automatically generates TLS certs and renews them with Let's Encrypt.

> Letsencrypt should serve its users, not force them onto anything.

The only way they can serve users is by forcing them to do the right thing.

You're insisting on doing the wrong thing and shouting at the people that are telling you how to do it right.

An analogy would be the equivalent of "not your wallet, not your crypto". Literally millions of naive crypto enthusiasts have just had $9B stolen from them by FTX because they didn't grasp this basic concept. They just wanted something convenient.

With something like PKI or cryptocoins, there are no shortcuts to security.

It's like sticky-taping your key to your locked front door.

Or writing your pin code on your credit card.

Or setting your password to "12345".

No one is stopping you from getting a 1-year cert from another CA and using that.

If you do not like the process LetsEncrypt uses, then you are not in their target market. That's fine; move on and use something else.

> I remember chinese websites issuing 3-year certificates. Wosign or something like that. That was the best experience I've ever had.

I remember Wosign! Man, what a terrible experience. The last thing I want is be forced to do system administration tasks manually by clicking around on a website. To be fair, it was great that it was available for its time, but I would never want to go back to something like that.

Reply on news.ycombinator.com