Let's make Let's Encrypt easy and simple

[pfg]

@david7364

'm still not quite understanding how you are saying that LE is out of Beta, but CertBot is not. I've been writing here again and again about how the LE startup page is not very good, and getting some support for that view. If LE itself is out of Beta, why can't the startup page just say that we are a CA and stop there?

ACME is a fairly new protocol. Many users wouldn't be happy with instructions that said "Let's Encrypt is an ACME-compatible CA. Our ACME server is https://acme-v01.api.letsencrypt.org/directory. Good luck!". Until ACME becomes a standard that's supported by multiple CAs and is known by everyone to a certain degree (see my earlier NTP reference), users will need some pointers with regards to the client ecosystem. Certbot happens to be the most commonly used and most active client implementations (plus, of course, it used to be made by the same organization behind Let's Encrypt ), so that's the recommendation.

@david7364

And why is LE still claiming to install or renew a certificate, if that is actually done by CertBot?

I haven't actually seen this phrase anywhere on the site right now. Here's what it says: "Certbot, the recommended Let’s Encrypt client, automates away the pain and lets site operators turn on and manage HTTPS with simple commands."

A lot of this confusion is probably due to the fact that it used to be one project. Hindsight is 20/20.

@david7364

If in your view LE is just a CA, then why is it any better than the other free CAs, like that one in Israel that has worked so hard to get itself set up right?

Aside from other things (short certificate lifetimes, transparency, ...), it's the fact that it implements ACME, which is on track to become a standard for automated certificate issuance. This is what allows web servers like Caddy to provide SSL completely transparently without any kind of user interaction or configuration.

StartSSL has actually implemented something similar a couple of weeks ago (though for some reason they decided to roll their own thing instead of adopting ACME). StartSSL is also only free for non-commercial usage. WoSign is free for any kind of usage, but has rather low domain limits and doesn't support automation.