Hacker News Reader

Comment by piperswe | Hacker News Reader

If people want longer certificate lifespans, they can get their certificates elsewhere. Part of the deal with getting a free certificate is that you're supposed to set up autorenewal with ACME. If you can't or don't want to do that, there are plenty of other CAs out there that will get you a long-life certificate.

View on HN

Nobody offers more than a year now. It’s annoying. So many old devices still need to be supported and can’t automatically update.

If these devices have internet access they can auto renew. If they don't, they don't need a cert signed by a public CA.

I partly agree with you, however it's possible for devices to have limited access to the internet, or even no direct access but still be accessible to devices that are on the internet.

If I have a smart device at home I may put it on a network that has no outgoing access to the internet, but it would still be nice to be able to connect to it with a web browser without getting angry expired certificate warnings.

It's not the worst problem to have, and I don't think it's easy to fix, but it's still annoying.

A company extranet locked by a whitelist of IP addresses comes to mind. You still want a SSL installed for security.

Yeah but that's a lot less common these days: https://www.usenix.org/system/files/login/articles/login_dec...

I don't want LE to waste money supporting such use cases.

Ever since LE added wildcards it’s not as bad - get the cert on one machine, copy it via scripts to all.

Is there a certbot client for ESXi?

> Nobody offers more than a year now.

Correct, because the CA/Browser Forum no longer permits CAs to issue certificates with validity longer than 13 months:

https://pkic.org/2020/07/09/one-year-certs/

Reply on news.ycombinator.com