Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I no longer have an old-school cert on my HTTPS site

rachelbythebay.com

Post reply on HN
Print view View original

51–60 of 437 posts

Re: Why I no longer have an old-school cert on my HTTPS site

#51

Post by giancarlostoro »

lucideer wrote: post #38
1a527dd5 wrote: post #9

I don't understand the tone of aggression against ACME and their plethora of clients. I know it isn't a skill issue because of who the author is. So I can only imagine it is some sort of personal opinion that they dislike ACME as a concept or the tooling around ACME in general. We've been using LE for a while (since 2019 I think) for handful of sites, and the best nonsense client _for us_ was https://github.com/do-kn…

> I don't understand the tone of aggression against ACME and their plethora of clients. > ACME idea good, ACME implementation bad. Maybe I'm misreading but it sounds like you're on a similar page to the author. As they said at the top of the article: > Many of the existing clients are also scary code, and I was not about to run any of them on my machines. They haven't earned the right to run with privileges for my pr…

Im not a container guru by any means (at least not yet?) but would docker not suffice these concerns?

Re: Why I no longer have an old-school cert on my HTTPS site

#53

Post by JoshTriplett »

sam_lowry_ wrote: post #49
g-b-r wrote: post #42

Earlier quoted context omitted.

For god's sake, however complex ACME might be it's better than not supporting TLS

Why? The days of MITM boxes injecting content into HTTP traffic are basically over, and frankly they never were a thing in my part of the world. I see no other reason to serve content over HTTPS.

> Why? The days of MITM boxes injecting content into HTTP traffic are basically over

The reason you don't see many MITM boxes injecting content into HTTP anymore is because of widespread HTTPS adoption and browsers taking steps to distrust HTTP, making MITM injection a near-useless tactic.

(This rhymes with the observation that some people now perceive Y2K as overhyped fear-mongering that amounted to nothing, without understanding that immense work happened behind the scenes to avert problems.)

Re: Why I no longer have an old-school cert on my HTTPS site

#54

Post by bananapub »

tangentially, for anyone looking to make their lives easier, you can run `acme-dns` on a spared 53/udp somewhere, CNAME the _acme_challenge. from your real DNS hosting to that, then have `lego` or whatever do DNS challenges via acme-dns - no need to let inscrutable scripts touch your real DNS config, no need for anything to touch your HTTP config.

Re: Why I no longer have an old-school cert on my HTTPS site

#56

Post by codeduck »

egorfine wrote: post #32

> import JSON (something I use as little as possible) This makes me wonder what world of development she is in. Does she prefer SOAP?

Given her experience and work history, it's much more likely that she views any text-based protocol as an unnecessary abstraction over simply processing raw TCP.

Re: Why I no longer have an old-school cert on my HTTPS site

#57

Post by jsheard »

KolmogorovComp wrote: post #55
orion138 wrote: post #47

Not the main point of the article, but the author’s comments on Gandi made me wonder: What registrar do people recommend in 2025?

Any feedback on CF one?

CF sells domains at cost so you're not going to beat them on price, but the catch is that domains registered through them are locked to their infrastructure, you're not allowed to change the nameservers. They're fine if you don't need that flexibility and they support the TLDs you want.

Re: Why I no longer have an old-school cert on my HTTPS site

#58

Post by samch »

orion138 wrote: post #47

Not the main point of the article, but the author’s comments on Gandi made me wonder: What registrar do people recommend in 2025?

Since you asked, I use Cloudflare for my registrar. I can’t really say if it’s objectively better or worse than anybody else, but they seemed like a good choice when Google was in the process of shutting off their registry service.

Re: Why I no longer have an old-school cert on my HTTPS site

#59

Post by graemep »

sloped wrote: post #52
orion138 wrote: post #47

Not the main point of the article, but the author’s comments on Gandi made me wonder: What registrar do people recommend in 2025?

Pork bun is my favorite.

It seems to be what Rachel decided on.

Must be other good ones? Somewhat prefer something in the UK (but have been using Gandi so its not essential).

Re: Why I no longer have an old-school cert on my HTTPS site

#60

Post by mattl »

graemep wrote: post #59
sloped wrote: post #52

Earlier quoted context omitted.

Pork bun is my favorite.

It seems to be what Rachel decided on. Must be other good ones? Somewhat prefer something in the UK (but have been using Gandi so its not essential).

Gandi prices went way way up. I've been using Porkbun too.
Post reply on HN