Re:Let's Automate Let's Encrypt
by dingaling on Tuesday November 01, 2016 @02:20PM
(#12848713)
> why is anyone purchases certs anymore ?
0. The cost of certificates is pretty insignificant to most corps.
1. They like to have someone to shout at when cert issuance fails. They happily pay money for this ( see point 0 ).
2. LE's cert renewal policies aren't compatible with most corporate change-management processes.
Having someone assigned to perform rolling cert changes every 60 days on every server just isn't feasible or desirable.
When I worked at "Fortune 50 Corp", an annual ( or even biannual / triannual ) planned cert update was a big deal and we had to stage the change across groups of servers in accordance with an algorithm that ensured that if they all inadvertently screwed-up that there enough servers with the old certs to keep production and pre-pro running.
3. Customers, particularly of financial insitutions, like to see the reassuring green EV indicator in their browser.
0. The cost of certificates is pretty insignificant to most corps.
1. They like to have someone to shout at when cert issuance fails. They happily pay money for this ( see point 0 ).
2. LE's cert renewal policies aren't compatible with most corporate change-management processes.
Having someone assigned to perform rolling cert changes every 60 days on every server just isn't feasible or desirable.
When I worked at "Fortune 50 Corp", an annual ( or even biannual / triannual ) planned cert update was a big deal and we had to stage the change across groups of servers in accordance with an algorithm that ensured that if they all inadvertently screwed-up that there enough servers with the old certs to keep production and pre-pro running.
3. Customers, particularly of financial insitutions, like to see the reassuring green EV indicator in their browser.