Re:Distrusting New WoSign and StartCom Certificates
by emilburzo on Tuesday October 25, 2016 @09:28AM
(#12787740)
Do you have multiple hosts serving the same domain by any chance?
I'm wondering if there's been any progress in finding an easy solution for this use-case.
Re:Distrusting New WoSign and StartCom Certificates
by pilif on Tuesday October 25, 2016 @09:42AM
(#12787863)
Many if not all of the acme clients out there store the key and certificate as a file. Just copy that to the various machines terminating the SSL connection.
In our case, there's a script on the frontend machine running HAProxy that's fetching the certificates and putting them on a shared file system so the backup machine also has access to them.
The traffic between frontend host and application servers is unencrypted in our case as it's all one rack under our control. If it wasn't, we'd be using a self-signed certificate for that connection.
I'm also glad it does not affect existing certs, since we need some weeks to ramp up the LE certs because of the 20 new certs per week limit (we can continue to only bundle subdomains per cert that are actually used on the same host/loadbalancer).