Hi, I’m Joshua Sylva, IT Technical Manager with San Luis Valley Health in Colorado.
We’re currently evaluating options to automate our SSL/TLS certificate renewal process, and Let’s Encrypt is one of the solutions we’d like to better understand.
Would someone from Let’s Encrypt/ISRG be available for a short technical overview or demo with our IT team? We’re especially interested in seeing how ACME-based certificate issuance and renewal automation could fit into an enterprise healthcare environment.
Thanks!
Let's Encrypt doesn't have any sort of "sales team" like you might be used to, since there is nothing for sale. All they have is a service that just runs and your software can use to get certificates. If you need like a support contract or SLAs or things along those lines (which I could understand needing in an environment like yours), you probably either need to find (1) some separate contractor that can handle the support needs of using a free CA like Let's Encrypt, or (2) use some other CA which offers those kinds of things directly.
Whether your services are using ACME (or some other automation) to get certificates, and whether the actual issuance of those certificates are free, and which CA is the one actually issuing those certificates, are really three separate questions.
What's your current CA provider? I'm sure they have plenty of options and tutorials for helping to add automation to your systems (or at least I would hope they would).
If you have some specific questions about ACME or about Let's Encrypt's service, you can certainly post here, and random community members like me can probably help point you to the answers when we have time. But I don't think you're likely to find someone with the time to just have a meeting with you (though I certainly could be wrong).
Thanks, Peter. That actually helps clarify things quite a bit.
Our main goal is really certificate lifecycle automation rather than specifically moving to Let’s Encrypt. We’re trying to reduce the manual work around tracking and renewing certificates across our environment.
We currently use Sectigo, so based on what you’re saying, it sounds like our best next step may be to look at what ACME/automation options Sectigo already provides and then compare that with other certificate lifecycle management options.
Appreciate you pointing me in the right direction!
Sectigo definitely supports automating your certs through them via ACME, and supporting you through migrations like that is exactly what you're paying them for.
I think the approach I would recommend is to work on automating everything through them first, so for the same systems that you currently get certs for, just automated instead. And then, once that's done, if you want to save a few bucks, it should be pretty straightforward to start pointing some systems to Let's Encrypt's ACME endpoint (or some other free or cheaper CA) instead, at least for things like dev environments. And maybe eventually for everything, if it turns out you don't need their support as much anymore, but you can worry about that decision later.