41–50 of 51 posts
This seems like a basic explanation of some of the stuff on the Let's Encrypt rate limit page (with some funny stuff mixed in to make it sounds like the rate limits for IPv6 are somehow higher), followed by a link to a product.
Every time LetsEncrypt is brought up I am reminded of "if it's for free, You are the product". In this case it is one's servers. A single company has a hand on the pulse and runs software on your server in exchange for continuous "convenience". I am still NOT buying in, diversifying SSL certs from reputable companies with 12 (or sometimes 13) months validity are still ok for me in 2017.
I don't like the idea of a monopoly either. But the issue here is what is "reputable". Most of (all?) the major commercial suppliers that I am aware of have been involved in major incidents. The only reputable supplier I could name, is LE.
But I personally like the fact there's much less commercial pressure on LE - for the time being at least.
ManageEngine Key Manager Plus ( https://www.manageengine.com/key-manager/ ) automates the entire process of procuring certificates, track expiry, renew and deployment of Let's Encrypt certificates.
Earlier quoted context omitted.
LE send you a mail if you have a cert going to expire. Easy to spot if something went wrong in your cron tasks (not that you can totally rely on automated task of course, but it's another layer of security)
Before someone complains that LE is going to spam you with expiry notices: If you set up your process right (i.e. certbot cronjob with --keep-until-expiring), certs will be renewed early enough that the mail reminder never triggers unless there's an actual problem.
So with a weekly cron (for example) you should never get any mail from LE. That's why I meant. Thanks again.
Ironic that the "https in browsers" figure uses a screenshot with a certificate MITM'd by the antivirus software. If you see "Secure" in the green bar instead of the domain name and EV attributes - your antivirus software is MITM'ing you.
Earlier quoted context omitted.
Why is your LE broken? 'because 1 of the 12 automated renewals last 3 years (to compare vs 3 year paid certificate at 4 euro) failed for reason X, Y or Z'. Be it them being down, be it your uplink being down, be it your dns malfunctioning, be it another massive spamhaus-sized-internet-disrupting-ddos. There are plenty of ways a LE renewal can go wrong, and having this 'chance' occur 4 times a year, i find bad practic…
> Be it them being down, be it your uplink being down, be it your dns malfunctioning, be it another massive spamhaus-sized-internet-disrupting-ddos. I have my certbot set to run once a week with --keep-until-expiring, so it will try to issue a new certificate when the old one's remaining validity is less than a month. I could also set it to run daily, because it doesn't actually do anything if the cert is still valid…
Is this really what i am reading?
Earlier quoted context omitted.
It's free, and automated so you don't run into TLS outage post-mortems where the question "why does the cert expire at christmas anyways?" is "Because it expired same time last year and during the emergency repair we used the default lifetime period of one year."
Why is your LE broken? 'because 1 of the 12 automated renewals last 3 years (to compare vs 3 year paid certificate at 4 euro) failed for reason X, Y or Z'. Be it them being down, be it your uplink being down, be it your dns malfunctioning, be it another massive spamhaus-sized-internet-disrupting-ddos. There are plenty of ways a LE renewal can go wrong, and having this 'chance' occur 4 times a year, i find bad practic…
Fortunately, we can also discard some of the high stakes gambles we take to avoid cert costs. Your cert lives for 90 days. Why wait until day 89 to renew? It's certainly not to avoid the expense. The LE defaults renew at day 70. That gives you 20 days for transient failures to resolve themselves, so that's a concern you can dismiss out of hand. And if you don't think that's enough time for ops team to work out whatever problem they have, you can configure your tooling to renew sooner.
Yes, renewals every 70 days introduces a 5th renewal every year, but IMO the hardest and most important renewal is the first one, and you might as well take it sooner than later.
TANASTAAFL is a thing, but even if the only lasting impact LE has is to arm-twist CAs into a commonly accepted API, that's still a win in my books for competition and near-frictionless competition. Anyone seen the Comodo API? And how it compares to the Symantec API?
Earlier quoted context omitted.
> Be it them being down, be it your uplink being down, be it your dns malfunctioning, be it another massive spamhaus-sized-internet-disrupting-ddos. I have my certbot set to run once a week with --keep-until-expiring, so it will try to issue a new certificate when the old one's remaining validity is less than a month. I could also set it to run daily, because it doesn't actually do anything if the cert is still valid…
So you prefer to have something (which most people have ) with root privileges to pull data unattended, 52 times a year, from some 3rd party host via python then to manually do (if you wanted ONLY once in 3 years) something once a year manually? Is this really what i am reading?
Professionally, it's not once every three years, it's that x the number of clients we host. Which is a lot. Many are clamoring for LE, because it's within their budget: $0. So yea, I want to automate that.
Earlier quoted context omitted.
> Be it them being down, be it your uplink being down, be it your dns malfunctioning, be it another massive spamhaus-sized-internet-disrupting-ddos. I have my certbot set to run once a week with --keep-until-expiring, so it will try to issue a new certificate when the old one's remaining validity is less than a month. I could also set it to run daily, because it doesn't actually do anything if the cert is still valid…
So you prefer to have something (which most people have ) with root privileges to pull data unattended, 52 times a year, from some 3rd party host via python then to manually do (if you wanted ONLY once in 3 years) something once a year manually? Is this really what i am reading?
Edit: Also, it's a persistent myth that certbot needs to run as root. It most certainly doesn't on my servers.
Earlier quoted context omitted.
I personally think it being a cron job is a bad idea. I do my LE cert renewal in the web server itself, so the web server would have to crash for the LE cert renewal to not run.
LE send you a mail if you have a cert going to expire. Easy to spot if something went wrong in your cron tasks (not that you can totally rely on automated task of course, but it's another layer of security)