Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LetsEncrypt Outage

letsencrypt.status.io

Post reply on HN
Print view View original

11–20 of 112 posts

Re: LetsEncrypt Outage

#11

Post by jasonthorsness »

Mostly this should be a non-event due to renewal long before expiration? Although huge deal I suppose for services that require issuing new certifications constantly; Let's Encrypt would be major failure mode for them.

As they move to shorter-lifetime certs (6 days now https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/?utm_s...) this puts it in the realm of possibility that an incident could impact long-running services.

Re: LetsEncrypt Outage

#12

Post by kenshaw »

jasonthorsness wrote: post #11

Mostly this should be a non-event due to renewal long before expiration? Although huge deal I suppose for services that require issuing new certifications constantly; Let's Encrypt would be major failure mode for them. As they move to shorter-lifetime certs (6 days now https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/?utm_s... ) this puts it in the realm of possibility that an incident could impact long-running…

I encountered this while trying to issue a new certificate for a service. As a temporary fix, started using ZeroSSL which conveniently also supports the ACME protocol. While not a big problem, if you have something like `cert-manager` being used on Kubernetes, then it requires quite a bit of reconfiguration, and you may spend a couple hours trying to figure out why a certificate hasn't been issued yet.

That said, I'm unbelievably grateful for the great product (and work!) LetsEncrypt has provided for free. Hope they're able to get their infrastructure back up soon.

Re: LetsEncrypt Outage

#13

Post by jasonthorsness »

kenshaw wrote: post #12
jasonthorsness wrote: post #11

Mostly this should be a non-event due to renewal long before expiration? Although huge deal I suppose for services that require issuing new certifications constantly; Let's Encrypt would be major failure mode for them. As they move to shorter-lifetime certs (6 days now https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/?utm_s... ) this puts it in the realm of possibility that an incident could impact long-running…

I encountered this while trying to issue a new certificate for a service. As a temporary fix, started using ZeroSSL which conveniently also supports the ACME protocol. While not a big problem, if you have something like `cert-manager` being used on Kubernetes, then it requires quite a bit of reconfiguration, and you may spend a couple hours trying to figure out why a certificate hasn't been issued yet. That said, I'm…

Let's Encrypt was a huge deal right from the beginning. They truly moved the web forward.

Here is the HN announcement: https://news.ycombinator.com/item?id=8624160

Announcement "animated" https://hn.unlurker.com/replay?item=8624160

Re: LetsEncrypt Outage

#15

Post by [deleted] »

jasonthorsness wrote: post #11

Mostly this should be a non-event due to renewal long before expiration? Although huge deal I suppose for services that require issuing new certifications constantly; Let's Encrypt would be major failure mode for them. As they move to shorter-lifetime certs (6 days now https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/?utm_s... ) this puts it in the realm of possibility that an incident could impact long-running…

[deleted]

Re: LetsEncrypt Outage

#16

Post by dwood_dev »

keysdev wrote: post #7

Shall we have some way of freely encrypting the web that is relying on one authority? Especially something that needed to be renewed every 90 or is it 40 days now. How about issuing 100 years certificates as a default?

This is largely not an issue thanks to ACME which they spearheaded. You can use multiple providers as backup options.

Also, you have days to weeks of slack time for renewals. The only real impact is trying to issue new certs if you are solely dependent on LE.

Re: LetsEncrypt Outage

#17

Post by greyface- »

Good time to note that Buypass offers free certificates over ACME. I have a few of my domains configured to use them instead of LetsEncrypt, just for redundancy and to ensure I have a working non-LE cert source in case LE suffers problems like this over a longer time period.

Example OpenBSD /etc/acme-client.conf:

  authority buypass {
   api url "https://api.buypass.com/acme/directory"
   account key "/etc/acme/buypass-privkey.pem"
   contact "mailto:youremail@example.com"
  }
  domain example.com {
   domain key "/etc/ssl/private/example.com.key"
   domain full chain certificate "/etc/ssl/example.com.pem"
   sign with buypass
  }
Post reply on HN