FYI, if you don't want to install all the dependencies of the official letsencrypt client, I made a https://github.com/diafygi/acme-tiny
This is my recommended client as well. Easy to use, easy to script, completely automatic. Well done.
Let’s encrypt automation on Debian
11–20 of 32 posts
Re: Let’s encrypt automation on Debian
#12This might be a dumb question, after I auto-generate all those ssl certs, how am I going to certify it at some CA? so that all browser will not pop up a warning page when the ssl-site is accessed? What's the key difference between letsencrypt and self-signed ssl certificate?
Letsencrypt is a trusted CA. https://letsencrypt.org/2015/10/19/lets-encrypt-is-trusted.h...
Re: Let’s encrypt automation on Debian
#13FYI, if you don't want to install all the dependencies of the official letsencrypt client, I made a https://github.com/diafygi/acme-tiny
Great! I did some work packaging the official Let's Encrypt client for GNU Guix and the dependency graph (complete with circular dependencies in all of the Zope mess) is absurdly huge. Definitely going to give this a try.
Re: Let’s encrypt automation on Debian
#14I really hope letsencrypt doesn't delay the real solution - DANE.
DANE certainly is not the real solution.
The solution is to deploy HPKP and require CT in the future.
Re: Let’s encrypt automation on Debian
#15Re: Let’s encrypt automation on Debian
#16I really hope letsencrypt doesn't delay the real solution - DANE.
Remedial question, for the unfamiliar folks: how do I establish a bootstrap trust w/DNSSEC? Does it require backwards-incompatible changes at the root?
The short story is that it's part of the root now, which is something resolvers ship with.
Re: Let’s encrypt automation on Debian
#17I really hope letsencrypt doesn't delay the real solution - DANE.
It's not a good solution.
Re: Let’s encrypt automation on Debian
#18This might be a dumb question, after I auto-generate all those ssl certs, how am I going to certify it at some CA? so that all browser will not pop up a warning page when the ssl-site is accessed? What's the key difference between letsencrypt and self-signed ssl certificate?
The certificates that Let's Encrypt issues are cross-signed by IdenTrust (a real CA) so browsers should trust the certificate you get from Let's Encrypt. NOTE: just like with other TLS certs, you will need to include the Let's Encrypt intermediate certificate in your webserver config so that it can be chained back to IdenTrust. EDIT: IdenTrust, not Entrust, sorry!
Let's Encrypt is cross-signed by IdenTrust, not Entrust.
Re: Let’s encrypt automation on Debian
#19FYI, if you don't want to install all the dependencies of the official letsencrypt client, I made a https://github.com/diafygi/acme-tiny
Head of Let's Encrypt here. I don't love the number of dependencies for our client either, we're going to work to reduce them.
Re: Let’s encrypt automation on Debian
#20Isn't Let's Encrypt supposed to launch the open beta today? Let's hope it actually happens...