[deleted]
Let's Encrypt is down
31–40 of 167 posts
Re: Let's Encrypt is down
#32Earlier quoted context omitted.
Wow @ that close comment: > So, this is not a bug and all is working as intended. Caddy folks had better never restart the caddy service (or server) while LE happens to be down, even if you already have a valid cert!
That's going to be a limiter for adoption. Hopefully @mholt reconsiders. Update: Mholt pushed a change where caddy only refuses to start if the cert is expiring in 7 days or less. https://github.com/mholt/caddy/commit/410ece831f26c61d392e0e...
Hm, yeah I hope so too :/ Been using Caddy in prod for a year now, this issue, rare as it may be, could single-handedly get me back on nginx.
Having the server be unable to start through circumstances outside of the system's control is just such a huge no.
Re: Let's Encrypt is down
#33Nothing against letsencrypt but dependencies on services to be online is fragile and will break. Their 90 day limit makes it worse. Saying its for security is like saying 1 or 3 year certs are somehow insecure which is not the case. It's one more headache for an admin to think about even if automated. We really should reexamine the CA system. Self signed certs should have more value than they currently do, and identi…
OK done: we move to self signed certs.
- Someone connects to wifi.
- The wifi gives a DNS server.
- The DNS server says some IP is foo.com.
- foo.com isn't actually the foo.com you expect [1], but it's got a self signed DV cert so you connect to it, and give some bad person your data.
That's why we don't more to self signed certs.
[1] Of course, if you want to assert foo.com is actually the 'Foo, Inc' you were expecting that's a job for EV.
Disclosure: I made https://certsimple.com that focuses on simplifying the identity verification process for EV certs.
Re: Let's Encrypt is down
#34On the plus side, as a side effect to this event, most of libraries shall start handling this case in better robust ways..
[deleted]
Re: Let's Encrypt is down
#35Clearly it is high time for an EncryptWeShall nonprofit with a wholly separate implementation and team and all the tooling adjusted to randomly pick between the two.
Re: Let's Encrypt is down
#36Earlier quoted context omitted.
That's going to be a limiter for adoption. Hopefully @mholt reconsiders. Update: Mholt pushed a change where caddy only refuses to start if the cert is expiring in 7 days or less. https://github.com/mholt/caddy/commit/410ece831f26c61d392e0e...
Hm, yeah I hope so too :/ Been using Caddy in prod for a year now, this issue, rare as it may be, could single-handedly get me back on nginx. Having the server be unable to start through circumstances outside of the system's control is just such a huge no.
Same here, was very pleased with Caddy so far, but it being tightly coupled to LE being up, despite having certs cached is a no-go for our production systems and if this stays like that, would make me go back to nginx for the services I've used caddy so far.
edit: looks like the dev added a fix to only refuse the start if the cached certs are dangerously close to expire. that satisfies me and I'll be continue to be using caddy.
Re: Let's Encrypt is down
#37Not only is it a problem with certificate issuance - but their OCSP servers are also down. This caused an issue on one of my sites where I was using OCSP Stapling: normal browser connections were failing, but not tools like curl (which don't ask for the OCSP response over SSL).
What's the typical validity period for OCSP responses with Let's Encrypt? Shouldn't the stapled responses continue working for at least a couple hours even after Let's Encrypt goes down?
1 week, so most servers likely won't be affected unless the outage goes on for a really long time.
Re: Let's Encrypt is down
#38This is also why you don't wait until the last day before renewing. (But no-one does that, right?)
If you use one of the myriad of automated tools for using LE, you will get your cert renewed as early as 30 days before it expires. So right now the issue should only be with new domains getting certs. If you renew LE certs manually, first what is wrong with you and don't you like yourself? Second, at that point it's no different than NameCheap going down and you getting your cert from 1and1 instead.
Wish someone would write one of those automated tools for Google App Engine-hosted apps.
That renewal process is exactly like regex. Once every three months I need it, and have to spend an hour re-learning it from scratch.
Re: Let's Encrypt is down
#39This is also why you don't wait until the last day before renewing. (But no-one does that, right?)
If you use one of the myriad of automated tools for using LE, you will get your cert renewed as early as 30 days before it expires. So right now the issue should only be with new domains getting certs. If you renew LE certs manually, first what is wrong with you and don't you like yourself? Second, at that point it's no different than NameCheap going down and you getting your cert from 1and1 instead.
> So right now the issue should only be with new domains getting certs.
Certainly should have been, but it looks like a lot of libraries are choking on the outage even if the old cert is 100% valid.
Re: Let's Encrypt is down
#40Holy frijoles, I was pondering exactly this scenario earlier today while messing around with Caddy and LE, as in: do I want to take a (mostly) static and offline process and directly inject it as another moving part into runtime world, for the sake of its cost, convenience, and overall worthwhileness?
Is there a good alternative, without this sort of process? Or back to the sharks?