Let’s encrypt automation on Debian

Post by nickik » Thu, Dec 03, 2015, 5:34 PM UTC

IshKebab wrote: post #27

_yy wrote: post #17

Earlier quoted context omitted.

It's not a good solution. https://www.imperialviolet.org/2015/01/17/notdane.html

The TL;DR of that is: 1. DNSSEC uses a lot of 1024-bit RSA signatures (those are relatively weak) 2. You can't monitor the certificates that CA's issue because anyone issue their own certificates. The first issue seems valid, but fixable. The second is a weird thing to complain about because it is the entire point of DANE!

Fixable but very unlikely to be fixed anytime sone. Plus the tons of technical issues that make it even more of a problem to use and maintain. To make it viable it would probably have to start over.

I'm not holding my breath.

Post by jannic » Thu, Dec 03, 2015, 6:15 PM UTC

diafygi wrote: post #28

joshmoz wrote: post #19

Earlier quoted context omitted.

Head of Let's Encrypt here. I don't love the number of dependencies for our client either, we're going to work to reduce them.

No worries! Every time I see a Let's Encrypt thread on HN, there's always complaining about having to trust the official client with root access, webserver configs, dependencies, or whatever. So I made my clients (letsencrypt-nosudo, gethttpsforfree.com, acme-tiny) to shut those people up. My clients are not intended to serve the wider Let's Encrypt target audience, who probably don't know what a CSR is. But for thos…

And thanks for writing acme-tiny!

It was really easy to setup automatic renewals, running as an ordinary user. sudo access for reloading apache is the only privileged operation necessary. Great job!

Re: Let’s encrypt automation on Debian

Re: Let’s encrypt automation on Debian