Hacker News Reader

Comment by basscomm | Hacker News Reader

> Since the advent of LetsEncrypt, ACME, and Caddy I haven't thought about SSL/TLS for more than about an hour per year

I run a couple of low-stakes websites just for fun and manually updating certificates takes me about 10 minutes a year, and most of that is remembering how to generate the csr. Setting up an automated process gains me nothing except additional points of failure. Ratcheting the expiration down to 47 days is an effort to force everyone to use automation, which makes no sense for small hobby sites.

> I'm not sure why many people are still dealing with legacy manual certificate renewal

Not everyone is a professional sysadmin. Adding automation is another layer of complexity on top of what it already takes to run a website. It's fine for large orgs and professionals who do this for a living at their day jobs, but for someone just getting their feet wet it's a ridiculous ask.

View on HN

> Ratcheting the expiration down to 47 days is an effort to force everyone to use automation, which makes no sense for small hobby sites.

you make it sound like setting up automated renewals is an onerous process. IME it takes about the same amount of time to set up the automation according to the directions as it does to manually renew the certs with an ACME client. the only difference is you're pasting a command into a crontab/timer instead of directly into your shell to execute.

> you make it sound like setting up automated renewals is an onerous process

The problem isn't that it's hard to set up. It's that it adds another thing that I have to monitor for failures and troubleshoot when it breaks. For a small hobby site, I might go longer than 47 days without looking at it.

fair point. for the stakes we're talking about, i've personally found it more than reliable for a handful of hobby sites i've hosted over the years, and i don't typically monitor the renewal process for those types of things.

ymmv. for me, i'll fix it if i have to, but i haven't yet :)

I run a few low-stakes hobby things, and LE cert automation took the "once a year or so figure out how to do this because I haven't done it in a year and I should write it down but when I'm done I just go to the pub instead" to "", which was a nice change. Now I only have to interact with it when I add a new vhost to the web server, and that's just run a command to do so.

> Ratcheting the expiration down to 47 days is an effort to force everyone to use automation

Forcing everyone to use automation sounds like a great idea. I am sure it is by design.

This is explicitly the purpose, yes.

Expecting someone to set up automation to manage one certificate on a hobby site is overkill

I catch your drift, but the browser needs to treat all sites more or less the same.

I’d say the easiest way out is to use the Caddy web server, which can take care of the certs all by itself.

I currently use XML and server-side XSLT to transform it because browser makers keep threatening to remove XSLT support (and I like to make it accessible for anyone using alternative browsers). Unless I'm missing something, Caddy doesn't support that, so that's a nonstarter unless I want to rewrite everything.

What's frankly ridiculous is that the big softwares like Nginx and Apache don't deal with this on their own. I've been letting Caddy (my http host of choice) deal with TLS for me for _ages_ now. I don't have to think about anything, I don't have to setup automation. I just... configure my caddy to host my website on https://my.domain.com and it just fetches the TLS for me, renews it when necessary, and uses it as necessary.

You don't need to be a professional sysadmin to deal with this - so long as the software you use isn't ass. Nginx will _finally_ get this ability in the next release (and it'll still be more configuration than caddy, that just defaults to the sane thing)...

Nginx just added support for acme iirc.

Apache has had mod_md since 2018 https://httpd.apache.org/docs/2.4/mod/mod_md.html

nginx gained that recently: https://nginx.org/en/docs/http/ngx_http_acme_module.html

I just can't come to terms with letting a public-facing web server write arbitrary data from the network to disk.

Are there any certain exploits you’re worried about?

Reply on news.ycombinator.com