Hacker News Reader

Comment by bombcar | Hacker News Reader

Nobody offers more than a year now. It’s annoying. So many old devices still need to be supported and can’t automatically update.

View on HN

> Nobody offers more than a year now.

Correct, because the CA/Browser Forum no longer permits CAs to issue certificates with validity longer than 13 months:

https://pkic.org/2020/07/09/one-year-certs/

If these devices have internet access they can auto renew. If they don't, they don't need a cert signed by a public CA.

I partly agree with you, however it's possible for devices to have limited access to the internet, or even no direct access but still be accessible to devices that are on the internet.

If I have a smart device at home I may put it on a network that has no outgoing access to the internet, but it would still be nice to be able to connect to it with a web browser without getting angry expired certificate warnings.

It's not the worst problem to have, and I don't think it's easy to fix, but it's still annoying.

A company extranet locked by a whitelist of IP addresses comes to mind. You still want a SSL installed for security.

Yeah but that's a lot less common these days: https://www.usenix.org/system/files/login/articles/login_dec...

I don't want LE to waste money supporting such use cases.

Ever since LE added wildcards it’s not as bad - get the cert on one machine, copy it via scripts to all.

Is there a certbot client for ESXi?

Reply on news.ycombinator.com