Hi, I’m Joshua Sylva, IT Technical Manager with San Luis Valley Health in Colorado.
We’re currently evaluating options to automate our SSL/TLS certificate renewal process, and Let’s Encrypt is one of the solutions we’d like to better understand.
Would someone from Let’s Encrypt/ISRG be available for a short technical overview or demo with our IT team? We’re especially interested in seeing how ACME-based certificate issuance and renewal automation could fit into an enterprise healthcare environment.
Let's Encrypt doesn't have any sort of "sales team" like you might be used to, since there is nothing for sale. All they have is a service that just runs and your software can use to get certificates. If you need like a support contract or SLAs or things along those lines (which I could understand needing in an environment like yours), you probably either need to find (1) some separate contractor that can handle the support needs of using a free CA like Let's Encrypt, or (2) use some other CA which offers those kinds of things directly.
Whether your services are using ACME (or some other automation) to get certificates, and whether the actual issuance of those certificates are free, and which CA is the one actually issuing those certificates, are really three separate questions.
What's your current CA provider? I'm sure they have plenty of options and tutorials for helping to add automation to your systems (or at least I would hope they would).
If you have some specific questions about ACME or about Let's Encrypt's service, you can certainly post here, and random community members like me can probably help point you to the answers when we have time. But I don't think you're likely to find someone with the time to just have a meeting with you (though I certainly could be wrong).
Thanks, Peter. That actually helps clarify things quite a bit.
Our main goal is really certificate lifecycle automation rather than specifically moving to Let’s Encrypt. We’re trying to reduce the manual work around tracking and renewing certificates across our environment.
We currently use Sectigo, so based on what you’re saying, it sounds like our best next step may be to look at what ACME/automation options Sectigo already provides and then compare that with other certificate lifecycle management options.
Appreciate you pointing me in the right direction!
Sectigo definitely supports automating your certs through them via ACME, and supporting you through migrations like that is exactly what you're paying them for.
I think the approach I would recommend is to work on automating everything through them first, so for the same systems that you currently get certs for, just automated instead. And then, once that's done, if you want to save a few bucks, it should be pretty straightforward to start pointing some systems to Let's Encrypt's ACME endpoint (or some other free or cheaper CA) instead, at least for things like dev environments. And maybe eventually for everything, if it turns out you don't need their support as much anymore, but you can worry about that decision later.
Also check out Certify Management Hub https://certifytheweb.com as that's a comprehensive administrative tool (which I work on) designed for this job.
You can continue to use Sectigo as a CA (or mix and match as you require) , it just provides tools to help manage the overall certificate renewal interdependently to the CA, so it's easy to move between different CAs and see how renewal for your organization are going. It's quite a new product but you can download an evaluate it without any limitations for as long as you need.
Our product is self-hosted by you, so there is no reliance on our managed infrastructure.
Overview:
Demo hub screenshot (with lots of errors only for illustration!):
There are 2 parts to certificate automation: renewal and deployment. Let's Encrypt as a CA, along with any ACME client handles renewing certificates automatically. There are lots of great tools that do this.
Deployment is the hard part. How do you get those certificates moved into where they need to be used. The Windows services and network appliances that need them. ACME client support on a lot of these things is spotty at best. If you use wildcards, which I think you do, then you have a whole scripting and deployment problem to move those certificates, securely, between all the systems that need them.
That's where CertKit really shines. We are a hosted ACME client that can get certs from LE, Sectigo, or any other ACME issuer. Then it pushes them automatically everywhere they need to be installed. We have over 80 built in integration targets today, and we're adding more all the time. Happy to give you a demo.
