Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rate Limits

letsencrypt.org

Post reply on HN
Print view View original

11–20 of 121 posts

Re: Rate Limits

#11

Post by Achshar »

JoshTriplett wrote: post #7
Achshar wrote: post #2

What I personally find more inconvenient than any of those limits (as a non-power user) is the 3 month lifetime of certs. I am a windows user. Running a VM once a month just to renew my 3 certs is a huge headache. Will it really be that much of a burden to have like a year? Not to mention the whole process is so very incredibly fugly. For something as important as it is why is there not an official online UI to manag…

> What I find more inconvenient than any of those limits (as a non-power user) is the 3 month lifetime of certs. I am a windows user. Running a VM once a month just to renew my 3 certs is a huge headache. Will it really be that much of a burden to have like a year? You shouldn't do anything by hand to renew certificates. The short certificate lifetime encourages you to automate the process. Clients exist for Windows,…

Those aren't really an option for me, I use shared hosting without command line access. I realize this is an issue specific to my case but I know many other people that have their own small sites running on similar hosting as mine.

Re: Rate Limits

#12

Post by JoshTriplett »

Achshar wrote: post #4
Aissen wrote: post #3

Earlier quoted context omitted.

I'm pretty sure there are letsencrypt windows clients. Which you can run every week to make sure they auto-renew. And you could do this as well by running the VM regularly, automatically. The point of letsencrypt is to have auto-renewed certificates. It's intended to force you to automate the process.

I can't run those scripts. My site runs on shared hosting, I don't have command line access. All I have is a file manager for my 'htdocs' and standard cpanel stuff.

Several shared hosting services offer native support for Let's Encrypt now. One of many lists: https://community.letsencrypt.org/t/web-hosting-who-support-...

It looks like current versions of CPanel now have native support for Let's Encrypt: https://features.cpanel.net/topic/provide-support-for-lets-e...

Re: Rate Limits

#13

Post by [deleted] »

verandaguy wrote: post #8
Achshar wrote: post #4

Earlier quoted context omitted.

I can't run those scripts. My site runs on shared hosting, I don't have command line access. All I have is a file manager for my 'htdocs' and standard cpanel stuff.

So... this is less an issue with Let's Encrypt and more an issue with restrictions imposed by cPanel and your choice of host.

[deleted]

Re: Rate Limits

#14

Post by verandaguy »

Achshar wrote: post #9
verandaguy wrote: post #8

Earlier quoted context omitted.

So... this is less an issue with Let's Encrypt and more an issue with restrictions imposed by cPanel and your choice of host.

In fact isn't shared hosting the most common type of hosting? Any larger sites can afford paid certs anyways so letsencrypt is especially suited for smaller sites like mine, that can't afford the cert but also don't have the luxury of a dedicated machine/vps.

@Achshar: VPSes have gotten exceptionally affordable lately. DO and AWS -- some of the current market leaders for cloud instances -- both offer reasonably-performant setups with high uptime for about $5/month, and that includes command-line access.

I'd argue that among people who know about Let's Encrypt, VPS hosting is more popular than cPanel-style shared hosting.

Re: Rate Limits

#15

Post by hannob »

Achshar wrote: post #11
JoshTriplett wrote: post #7

Earlier quoted context omitted.

> What I find more inconvenient than any of those limits (as a non-power user) is the 3 month lifetime of certs. I am a windows user. Running a VM once a month just to renew my 3 certs is a huge headache. Will it really be that much of a burden to have like a year? You shouldn't do anything by hand to renew certificates. The short certificate lifetime encourages you to automate the process. Clients exist for Windows,…

Those aren't really an option for me, I use shared hosting without command line access. I realize this is an issue specific to my case but I know many other people that have their own small sites running on similar hosting as mine.

Your web hoster should integrate a way to automatically get certificates. Many already do. If they don't offer that you may want to consider using another webhoster.

Re: Rate Limits

#16

Post by toomuchtodo »

jaas wrote: post #5
Achshar wrote: post #2

What I personally find more inconvenient than any of those limits (as a non-power user) is the 3 month lifetime of certs. I am a windows user. Running a VM once a month just to renew my 3 certs is a huge headache. Will it really be that much of a burden to have like a year? Not to mention the whole process is so very incredibly fugly. For something as important as it is why is there not an official online UI to manag…

We could very easily make the cert lifetimes one year, or anything else. We chose 90 days for the reasons outlined here: https://letsencrypt.org/2015/11/09/why-90-days.html Additionally, long cert lifetimes are dangerous because revocation is ineffective and things like heartbleed happen.

I appreciate what Let's Encrypt is doing, and have even donated, but internally at our org (as a DevOps), I cannot sell certs that expire every 90 days; $300/year for a wildcard cert is a small price to pay for 1 year expirations.

Re: Rate Limits

#17

Post by schoen »

Achshar wrote: post #11
JoshTriplett wrote: post #7

Earlier quoted context omitted.

> What I find more inconvenient than any of those limits (as a non-power user) is the 3 month lifetime of certs. I am a windows user. Running a VM once a month just to renew my 3 certs is a huge headache. Will it really be that much of a burden to have like a year? You shouldn't do anything by hand to renew certificates. The short certificate lifetime encourages you to automate the process. Clients exist for Windows,…

Those aren't really an option for me, I use shared hosting without command line access. I realize this is an issue specific to my case but I know many other people that have their own small sites running on similar hosting as mine.

If continuing to use your current hosting provider is important to you, I suggest you ask them to integrate Let's Encrypt on their end. (That could include just letting you get Let's Encrypt certs through cPanel; it doesn't necessarily have to mean a lot of coding for them.) We've been talking to a number of providers of various shapes and sizes who are doing this or planning to do it. It's the best option for hosting environments where the customer doesn't have administrative access.

Re: Rate Limits

#18

Post by reacweb »

Achshar wrote: post #4
Aissen wrote: post #3

Earlier quoted context omitted.

I'm pretty sure there are letsencrypt windows clients. Which you can run every week to make sure they auto-renew. And you could do this as well by running the VM regularly, automatically. The point of letsencrypt is to have auto-renewed certificates. It's intended to force you to automate the process.

I can't run those scripts. My site runs on shared hosting, I don't have command line access. All I have is a file manager for my 'htdocs' and standard cpanel stuff.

Even if you do not have command line, you probably have ftp or sftp access. If you search for filezilla in your share hosting forums, you will probably find the protocol and url.

Re: Rate Limits

#19

Post by devy »

toomuchtodo wrote: post #16
jaas wrote: post #5

Earlier quoted context omitted.

We could very easily make the cert lifetimes one year, or anything else. We chose 90 days for the reasons outlined here: https://letsencrypt.org/2015/11/09/why-90-days.html Additionally, long cert lifetimes are dangerous because revocation is ineffective and things like heartbleed happen.

I appreciate what Let's Encrypt is doing, and have even donated, but internally at our org (as a DevOps), I cannot sell certs that expire every 90 days; $300/year for a wildcard cert is a small price to pay for 1 year expirations.

I think LE's 90-day expiration reason #2 is really the key: encouraging automation. So what it really is investing effort once and working for arbitrarily period of time. If the TLS certificate renewal process cannot be automated but must be manually done for some reason, that perhaps LE certificates are really not what you are looking for.

Re: Rate Limits

#20

Post by jaas »

Achshar wrote: post #2

What I personally find more inconvenient than any of those limits (as a non-power user) is the 3 month lifetime of certs. I am a windows user. Running a VM once a month just to renew my 3 certs is a huge headache. Will it really be that much of a burden to have like a year? Not to mention the whole process is so very incredibly fugly. For something as important as it is why is there not an official online UI to manag…

Regarding your experience getting and managing certificates, I'm sorry to hear that you're having a difficult time.

Our goal is to encrypt the entire Web, and that means working with an almost innumerable combination of operating systems, server software, hosting providers, management interfaces, permissions, deployment strategies... Most people have a very positive experience using Let's Encrypt but it's difficult to ensure that everyone does.

It's not possible for us to build the tools necessary for every situation (financially or otherwise). Our strategy, which has been working pretty well so far, is to focus on running a secure, stable, and well-documented CA API and let our community decide what clients need to be built (and build them). This has resulted in a range of client software suitable for different situations and preferences:

https://letsencrypt.org/docs/client-options/

This includes web-based interfaces for getting certificates from Let's Encrypt (see the "Browser" section of the client options document). Hopefully one of these will work well for you.

Post reply on HN