What I personally find more inconvenient than any of those limits (as a non-power user) is the 3 month lifetime of certs. I am a windows user. Running a VM once a month just to renew my 3 certs is a huge headache. Will it really be that much of a burden to have like a year? Not to mention the whole process is so very incredibly fugly. For something as important as it is why is there not an official online UI to manag…
What I personally find more inconvenient than any of those limits (as a non-power user) is the 3 month lifetime of certs. I am a windows user. Running a VM once a month just to renew my 3 certs is a huge headache. Will it really be that much of a burden to have like a year? Not to mention the whole process is so very incredibly fugly. For something as important as it is why is there not an official online UI to manag…
> What I find more inconvenient than any of those limits (as a non-power user) is the 3 month lifetime of certs. I am a windows user. Running a VM once a month just to renew my 3 certs is a huge headache. Will it really be that much of a burden to have like a year? You shouldn't do anything by hand to renew certificates. The short certificate lifetime encourages you to automate the process. Clients exist for Windows,…
I experimented with LetsEncrypt a few months ago, and found the process to be VERY manual. This was on a bog-standard Debian install running common web software (lighttpd) with a few vhosts. Certbot does not seem to support lighttpd, so it's: download this third party script, run this, copy that, run this, cat these files together, restart the web server process, etc. Sure, that can all be cobbled together with your own mega-script, but at that point, you start just looking for another provider (which OP did). If I were not as comfortable with the command line as I am, I'd have found the initial setup to be daunting, let alone automating it.
We could very easily make the cert lifetimes one year, or anything else. We chose 90 days for the reasons outlined here: https://letsencrypt.org/2015/11/09/why-90-days.html Additionally, long cert lifetimes are dangerous because revocation is ineffective and things like heartbleed happen.
I appreciate what Let's Encrypt is doing, and have even donated, but internally at our org (as a DevOps), I cannot sell certs that expire every 90 days; $300/year for a wildcard cert is a small price to pay for 1 year expirations.
I'd absolutely love to have wildcard certificates as well. I think Let's Encrypt has plans to offer them, as soon as they finish producing a new version of the ACME standard that supports authorizing them.
I think LE's 90-day expiration reason #2 is really the key: encouraging automation. So what it really is investing effort once and working for arbitrarily period of time. If the TLS certificate renewal process cannot be automated but must be manually done for some reason, that perhaps LE certificates are really not what you are looking for.
The chances of automation failing is higher than the chance our SSL certs will need revocation. With that said, still a big supporter of Let's Encrypt for folks who can tolerate the constraints.
Automation failing once shouldn't be a catastrophe; you could renew after 30 days and issue a pager alert if it fails. Then you'd have 60 days to figure out what went wrong, manually update it, and fix the issue with the automation.
I wish they didn't have the limit of 20 certs per registered domain.
There are a lot of use cases this blocks - Plex's use case [1] where they issued certs for all their users; large organisations (I'm sure there are more than 20 sites run under .mit.edu sites by different teams who wouldn't want to share multi-name certificates); and of course using ISP-assigned hostnames like host86-186-141-3.range86-186.btcentralplus.com (admittedly there are other reasons LE might not want to issue certs for that final case).
Does anyone know the reason for that limit? It seems quite low considering they allow 500 certs per IP address and 300 pending authorizations at a time :)
> What I find more inconvenient than any of those limits (as a non-power user) is the 3 month lifetime of certs. I am a windows user. Running a VM once a month just to renew my 3 certs is a huge headache. Will it really be that much of a burden to have like a year? You shouldn't do anything by hand to renew certificates. The short certificate lifetime encourages you to automate the process. Clients exist for Windows,…
Those aren't really an option for me, I use shared hosting without command line access. I realize this is an issue specific to my case but I know many other people that have their own small sites running on similar hosting as mine.
If you have it scripted in a vm, I think that you should set up a vps that turns on every month and runs it.
Even if you do not have command line, you probably have ftp or sftp access. If you search for filezilla in your share hosting forums, you will probably find the protocol and url.
Yeah I have FTP. But can I install certs via ftp? I mean yeah sure I guess since they are just files but won't that be like too much work? Knowing what to put where and how. cPanel is a lot simpler. Paste cert and private key, press submit.
It's not a huge time investment to learn how to do something like FTPing a cert (much less so for someone getting a Masters in Computers). Your time would be much better spent learning how to do it than spam replying "I don't have the time to learn" all over the thread. /rant
I think LE's 90-day expiration reason #2 is really the key: encouraging automation. So what it really is investing effort once and working for arbitrarily period of time. If the TLS certificate renewal process cannot be automated but must be manually done for some reason, that perhaps LE certificates are really not what you are looking for.
The chances of automation failing is higher than the chance our SSL certs will need revocation. With that said, still a big supporter of Let's Encrypt for folks who can tolerate the constraints.
> The chances of automation failing is higher than the chance our SSL certs will need revocation.
Given a 90-day duration, set up automated renewal for every 30 days, and if that renewal fails, you'll have 60 days to deal with it.
> What I find more inconvenient than any of those limits (as a non-power user) is the 3 month lifetime of certs. I am a windows user. Running a VM once a month just to renew my 3 certs is a huge headache. Will it really be that much of a burden to have like a year? You shouldn't do anything by hand to renew certificates. The short certificate lifetime encourages you to automate the process. Clients exist for Windows,…
I experimented with LetsEncrypt a few months ago, and found the process to be VERY manual. This was on a bog-standard Debian install running common web software (lighttpd) with a few vhosts. Certbot does not seem to support lighttpd, so it's: download this third party script, run this, copy that, run this, cat these files together, restart the web server process, etc. Sure, that can all be cobbled together with your…
Even better than certbot supporting it would be if lighttpd supported ACME natively. You might file a feature request with lighttpd requesting native ACME/LE support.
The chances of automation failing is higher than the chance our SSL certs will need revocation. With that said, still a big supporter of Let's Encrypt for folks who can tolerate the constraints.
Automation failing once shouldn't be a catastrophe; you could renew after 30 days and issue a pager alert if it fails. Then you'd have 60 days to figure out what went wrong, manually update it, and fix the issue with the automation.
At fully loaded engineer costs, if someone takes more than an hour or two to investigate, its already more expensive than a wildcard cert.