News for hackers. Stuff that matters.
Re:Let's Encrypt Has Issued a Billion Certificates by joering2 on Thursday February 27, 2020 @12:44PM (#22435629)
> I shudder to think about what will happen if they go down for whatever reason.

We would quickly see article and reminder that free means you are not the client :)

Just recently I had issues with Lets Encrypt bot. Apparently on new version of Centos it craps out with some incompatible python libraries. Once I fixed it it turned out I am blacklisted from requesting new certs for 7 days, per their rate limits. That made me come back to drawing board for 60-some domains I ran and just purchase the damn certs. They so cheap these days unless you ran a hobby website its just not worth the savings.

Re:Let's Encrypt Has Issued a Billion Certificates by schoen on Thursday February 27, 2020 @02:24PM (#22436796)
> it turned out I am blacklisted from requesting new certs for 7 days, per their rate limits

The rate limit for failed issuance is one hour, not 7 days. The 7 day rate limit applies when you successfully issue 5 identical certificates; then you have to wait 7 days more to issue a new identical certificate.

https://letsencrypt.org/docs/rate-limits/

It's unlikely that you would be subject to the 7 day duplicate certificate limit due to a Certbot dependency problem, because the dependency problem would have to allow Certbot to obtain the certificates correctly but fail to save them properly.

(Source: I'm a Certbot developer.)

I should also add that I'm really sorry that you experienced an installation problem on CentOS. Dependency and packaging problems continue to be a challenge for Certbot and our colleagues are still trying to find a more universal solution to them (probably involving snaps).

Re:Let's Encrypt Has Issued a Billion Certificates by cuspycode on Thursday February 27, 2020 @03:04PM (#22437215)
I had similar problems with that bot recently (i.e. the python bot "certbot"), so I looked around and found a very nice alternative named PJAC[0]. I have now switched a bunch of my domains to use PJAC, and so far it works like a charm. Its only dependency is Java (version 8 or higher). Everything else is bundled in the downloaded artifact, just as it should be.

[0] https://github.com/porunov/acme_client

Re:Let's Encrypt Has Issued a Billion Certificates by alwillis on Friday February 28, 2020 @03:01AM (#22441255)
I’m a fan of acme.sh [1]. It’s a battle-tested Bash script that handles many different use cases, including many DNS providers if dns-01 is how you roll.

I run my own DNS server using Knot and acme.sh supports it.

[1]: https://github.com/acmesh-official/acme.sh