News for hackers. Stuff that matters.

A comment on Automate Public Certificates Lifecycle Management via RFC 8555 (ACME). Parent comment

Re:Automate Public Certificates Lifecycle Management via RFC... by minerva23 on Tuesday April 12, 2022 @01:08AM (#30998847)
As a Let’s Encrypt user and fan, I can answer this.

LE is great, but their SLO is significantly below our customers’ expectations. For us, Google wouldn’t replace LE, it would supplement LE for higher reliability.

Seeing more providers conforming to ACME at a price point of “free” is great for the ecosystem.

[ Parent | on HN ]
Re:Automate Public Certificates Lifecycle Management via RFC... by tehbeard on Tuesday April 12, 2022 @03:54AM (#30999797)
Is this with provisioning many new certs?

The recommended renewal cycle gives you a 30 day lead on failure becoming a problem, plenty of time for multiple retries or recovery processes to use an alternate.

The only issues I've ran into, have stemmed from DNS for wildcard certs, where a client's DNS provider is... pretty crap about updating records despite low ttls being set.

[ Parent | on HN ]
Re:Automate Public Certificates Lifecycle Management via RFC... by minerva23 on Tuesday April 12, 2022 @10:22AM (#31003133)
It’s a web hosting business. New customers want effortless free TLS asap. We get customers who routinely create new sites who come to expect fast provisioning.
[ Parent | on HN ]
Re:Automate Public Certificates Lifecycle Management via RFC... by michaelt on Tuesday April 12, 2022 @06:19AM (#31000701)
Some people on the cloud like to issue a certificate per machine, so no ACME = no new VMs.
[ Parent | on HN ]