News for hackers. Stuff that matters.

A comment on Another free CA as an alternative to Let's Encrypt. Parent comment

Re:Another free CA as an alternative to Let's Encrypt by TekMol on Friday August 20, 2021 @12:50PM (#28248235)
Even more moving parts you need to set up and maintain.

It introduces a 4th party you depend on. Now you have:

1: The datacenter where your application runs

2: The DNS server

3: Let's Encrypt

4: The "DNS provider with a better API"

[ Parent | on HN ]
Re:Another free CA as an alternative to Let's Encrypt by rossy on Friday August 20, 2021 @10:07PM (#28253445)
The "DNS provider with a better API" can be your own bind9 server on the same machine as certbot, updated with RFC 2136. Completely standard, no changing APIs, no 4th party, no maintenance. I set up a server like this at work and haven't touched it for a year and a half.
[ Parent | on HN ]
Re:Another free CA as an alternative to Let's Encrypt by gunapologist99 on Saturday August 21, 2021 @11:31AM (#28257783)
bind hasn't exactly had a flawless security history...

(also hope that not touching it means you've automated security updates at least)

[ Parent | on HN ]
Re:Another free CA as an alternative to Let's Encrypt by blibble on Friday August 20, 2021 @08:05PM (#28252782)
use the same provider (but a different account)?

you are unavoidably dependent on 1-3 anyway

[ Parent | on HN ]