11–20 of 51 posts
Earlier quoted context omitted.
I just have an ansible role which runs against a server and SSL gets set up 100% for free. It's wonderful. One time time investment to write the ansible role, and now it takes like 5 seconds to enable for any server I'd like.
So that's the provisioning process at server setup/instantiation; how do you handle the 90 day renewal?
Earlier quoted context omitted.
I just have an ansible role which runs against a server and SSL gets set up 100% for free. It's wonderful. One time time investment to write the ansible role, and now it takes like 5 seconds to enable for any server I'd like.
So that's the provisioning process at server setup/instantiation; how do you handle the 90 day renewal?
Like with a lot of tech trends, I seem to be one of those people who doesn't "get" the excitement about letsencrypt. I don't find the process of generating a CSR and submitting it to a CA for signing to be more complicated than setting up letsencrypt. In fact I think it's quite a bit easier.
Setting up LE requires you to do/learn a new process, so it's expected that it looks more complicated than the process you already know. But once you get past that, it's soooo much easier. All my domains are renewed via a cronjob. I don't have to do anything.
(Not that I think cron is unreliable - I only recently stopped getting monitoring summary email from a cron job I set up in '99 or '00 on a server that'd been migrated at least 3 times while I still worked there, and who knows how many times after I left in '08, I stopped getting the mail in '14 or '15... But I've also had cron jobs silently die when OS updates break perl/python/shell scripts or permissions - looking at _you_ OS X...)
Like with a lot of tech trends, I seem to be one of those people who doesn't "get" the excitement about letsencrypt. I don't find the process of generating a CSR and submitting it to a CA for signing to be more complicated than setting up letsencrypt. In fact I think it's quite a bit easier.
I have a node that can log in to other nodes, enumerate the domains they host, and then go through the LetsEncrypt authentication process for every domain on that node, retrieve the new certificate, copy it up to that node, and kick any services that need to be kicked. It runs once a day to handle renewals, or I can run it manually any time the hosting on a node changes.
I haven't had to think about SSL for quite a while now and that's fantastic.
If you're only responsible for one or a few domains, I can see how that wouldn't seem like a big deal.
Earlier quoted context omitted.
Setting up LE requires you to do/learn a new process, so it's expected that it looks more complicated than the process you already know. But once you get past that, it's soooo much easier. All my domains are renewed via a cronjob. I don't have to do anything.
… except ensure the cron job runs reliably on a timescale of years… (Not that I think cron is unreliable - I only recently stopped getting monitoring summary email from a cron job I set up in '99 or '00 on a server that'd been migrated at least 3 times while I still worked there, and who knows how many times after I left in '08, I stopped getting the mail in '14 or '15... But I've also had cron jobs silently die when…
Earlier quoted context omitted.
… except ensure the cron job runs reliably on a timescale of years… (Not that I think cron is unreliable - I only recently stopped getting monitoring summary email from a cron job I set up in '99 or '00 on a server that'd been migrated at least 3 times while I still worked there, and who knows how many times after I left in '08, I stopped getting the mail in '14 or '15... But I've also had cron jobs silently die when…
I personally think it being a cron job is a bad idea. I do my LE cert renewal in the web server itself, so the web server would have to crash for the LE cert renewal to not run.
Like with a lot of tech trends, I seem to be one of those people who doesn't "get" the excitement about letsencrypt. I don't find the process of generating a CSR and submitting it to a CA for signing to be more complicated than setting up letsencrypt. In fact I think it's quite a bit easier.
"I don't find the process of generating a CSR and submitting it to a CA for signing to be more complicated than setting up letsencrypt." Remember there's multiple benefits that Lets Encrypt claims. A few that come to mind is it's free, transparent instead of shady, and has this tooling ecosystem forming. The free and non-shady parts are the most compelling advantages over prior, commercial CA's. On top of that, it's…
On the plus side, I was aware of every cert that got set up and several of them were going to be created improperly or for sketchy reasons.
Like with a lot of tech trends, I seem to be one of those people who doesn't "get" the excitement about letsencrypt. I don't find the process of generating a CSR and submitting it to a CA for signing to be more complicated than setting up letsencrypt. In fact I think it's quite a bit easier.
Either use Caddy (1) or integrate with nginx, traefik, gke or any other kubernetes ingress server via kube-lego (2).
1: https://caddyserver.com/ 2: https://github.com/jetstack/kube-lego