I am running an HTTP-only blog and it's getting harder every year not to switch to HTTPS.
For instance, Whatsapp can not open HTTP links anymore.
Why I no longer have an old-school cert on my HTTPS site
21–30 of 437 posts
Re: Why I no longer have an old-school cert on my HTTPS site
#22I was amazed by them having so much distrust of the various clients. Certbot is typically in the repositories for things like Debian/Ubuntu. My favourite client is probably https://github.com/acmesh-official/acme.sh If you use a DNS service provider that supports it, you can use the DNS-01 challenge to get a certificate - that means that you can have the acme.sh running on a completely different server which should h…
Agree with the acme.sh recommendation. It's my favourite by far (especially, as you point out, when leveraging with DNS-01 challenges so you can sidestep most of the security risks the article author worries about)
Re: Why I no longer have an old-school cert on my HTTPS site
#23I don't understand the tone of aggression against ACME and their plethora of clients. I know it isn't a skill issue because of who the author is. So I can only imagine it is some sort of personal opinion that they dislike ACME as a concept or the tooling around ACME in general. We've been using LE for a while (since 2019 I think) for handful of sites, and the best nonsense client _for us_ was https://github.com/do-kn…
Some people don't want to be forced to run a bunch of stuff they don't understand on the server, and I agree with them. Sadly, security is a cat and mouse game, which means it's always evolving and you're forced to keep up - and it's inherent by the nature of the field, so we can't really blame anyone (unlike, say, being forced to integrate with the latest Google services to be allowed on the Play Store). At least yo…
> Some people don't want to be forced to run a bunch of stuff they
> don't understand on the server, and I agree with them.
Honest question:
* Do you understand OS syscalls in detail?
* Do you understand how your BIOS initializes your hardware?
* Do you understand how modern filesystems work?
* Do you understand the finer details of HTTP or TCP?
Because... I don't. But I know enough about them that I'm quite convinced each of them is a lot more difficult to understand than ACME. And all of them and a lot more stuff are required if you want to run a web server.
Re: Why I no longer have an old-school cert on my HTTPS site
#24I was amazed by them having so much distrust of the various clients. Certbot is typically in the repositories for things like Debian/Ubuntu. My favourite client is probably https://github.com/acmesh-official/acme.sh If you use a DNS service provider that supports it, you can use the DNS-01 challenge to get a certificate - that means that you can have the acme.sh running on a completely different server which should h…
Certbot goes out of its way to be inscrutable about what it’s doing. It munges your web server config (temporarily) to handle http challenges, and for true sysadmins who are used to having to know all the details of what’s going on, that sort of script is a nightmare waiting to happen. I assume certbot is the client she’s alluding to that misinterprets one of the factors in the protocol as hex vs decimal and somehow…
You can configure certbot to write in a directory directly and it won't touch your web server config.
Re: Why I no longer have an old-school cert on my HTTPS site
#25I was amazed by them having so much distrust of the various clients. Certbot is typically in the repositories for things like Debian/Ubuntu. My favourite client is probably https://github.com/acmesh-official/acme.sh If you use a DNS service provider that supports it, you can use the DNS-01 challenge to get a certificate - that means that you can have the acme.sh running on a completely different server which should h…
I used to like them, then they somehow sold out to zerossl and switched the default there from LE after an update. Pinned to an old version and looking for a replacement right now.
That annoyed me as well given the wording on the ZeroSSL site suggested one has to create an account which is not true. I had hit an error using DNS-01 at the time. They have an entirely different page for ACME clients but it is not or was not linked from anywhere on the main page.
If anyone else ran into that it's just a matter of adding
--server letsencryptRe: Why I no longer have an old-school cert on my HTTPS site
#26With the greatest respect to Rachel, ain't _nobody_ got time for that.
Re: Why I no longer have an old-school cert on my HTTPS site
#27Re: Why I no longer have an old-school cert on my HTTPS site
#28> This complexity must be job security for somebody. Maybe multiple somebodies.
This. The 90 day certs of LE are terrible (I hit 1-2 sites a week broken b/c of expired LE certs) and unnecessary, and all part of a bigger trend by big business to control more of the web. LE could be a voice for the user, but the "non-profit" pays their team ~$250K/year so they tread carefully about doing things in the average user's interests.
Re: Why I no longer have an old-school cert on my HTTPS site
#29Earlier quoted context omitted.
Some people don't want to be forced to run a bunch of stuff they don't understand on the server, and I agree with them. Sadly, security is a cat and mouse game, which means it's always evolving and you're forced to keep up - and it's inherent by the nature of the field, so we can't really blame anyone (unlike, say, being forced to integrate with the latest Google services to be allowed on the Play Store). At least yo…
> Some people don't want to be forced to run a bunch of stuff they > don't understand on the server, and I agree with them. Honest question: * Do you understand OS syscalls in detail? * Do you understand how your BIOS initializes your hardware? * Do you understand how modern filesystems work? * Do you understand the finer details of HTTP or TCP? Because... I don't. But I know enough about them that I'm quite convince…
Sure - but people are still free to decide where they draw the line.
Each extra bit of software is an additional attack surface after all
Re: Why I no longer have an old-school cert on my HTTPS site
#30I was amazed by them having so much distrust of the various clients. Certbot is typically in the repositories for things like Debian/Ubuntu. My favourite client is probably https://github.com/acmesh-official/acme.sh If you use a DNS service provider that supports it, you can use the DNS-01 challenge to get a certificate - that means that you can have the acme.sh running on a completely different server which should h…
certbot is complexity creep at it's finest. I'd love to hear Rachel's take on it.
+1 for acme.sh, it's beautiful.