Re:Automate Public Certificates Lifecycle Management via RFC...
by fomine3 on Monday April 11, 2022 @11:49PM
(#30998381)
LE has compatibility issue with very old Android/OpenSSL. https://community.letsencrypt.org/t/production-chain-changes... Possibly Google's cert doesn't have the issue?
[ Parent
| on HN ]
Re:Automate Public Certificates Lifecycle Management via RFC...
by kijin on Tuesday April 12, 2022 @12:17AM
(#30998569)
Yeah, that transition didn't go as smoothly as they might have hoped. Most of us first-world programmers can just shrug and say "don't use unsupported versions," but I've had multiple non-technical clients call me up urgently and ask why a (relatively small, but not insignificant depending on the market, and definitely not in their control) subset of their users were seeing certificate errors.
So I don't recommend LE to my clients anymore. But it's a hassle to buy certificates the old way after having tasted ACME, so I'm always looking for an ACME-compatible alternative. ZeroSSL is backed by a more conservative Sectigo CA, but its ACME endpoints aren't very reliable. If this Google cert becomes widely available, I might just as well switch to it. :)
Re:Automate Public Certificates Lifecycle Management via RFC...
by pronoiac on Tuesday April 12, 2022 @01:54AM
(#30999081)
From memory, ZeroSSL also gets expensive after a couple of domains, and I had issues using certbot rather than acme.sh with it.
Re:Automate Public Certificates Lifecycle Management via RFC...
by kijin on Tuesday April 12, 2022 @07:51AM
(#31001329)
Nowadays you can get virtually unlimited 90-day certs from ZeroSSL if you use ACME through the EAB feature rather than using their API.
But their ACME support seems half-hearted at best. The endpoints often return errors for no reason, compatibility with clients is hit-and-miss, and they keep spamming you with renewal notices even if you renew the cert. For important domains these days I just get a cheap 1-year DV cert like the good ol' days.