I thought the point of LE was to encourage use of SSL, not to force people into a particular workflow that they may neither want to nor be able to follow. I’m not going to repeat the arguments that have already been given (you quite clearly seem not to care), so all I will say is that I’m incredibly disappointed. The promise of more widespread SSL was a great one, and it’s sad to see that it’s no better than any other free solutions. I guess a lot of people will be stuck with either paying out the nose for overly priced certs or, more likely, taking the easy route and just not bothering.
Your original stated goal was to increase SSL adoption. Forcing people into a particular way of working just adds friction to this effort.
Blog only addresses why 90. It does not make the case for NOT permitting 1 year. You act as though they are mutually exclusive. They are not. Make 90 the default for fully automated. Allow 1 year for manual.
Your trying to use LE as a behavioral driver is just total wrong headed.
This tutorial by @renchap solved all of my “renewal” problems. It doesn’t even need to stop the server to pass the challenge. Honestly, renewing certs every 60 days might be great; it forces us to automate everything and eliminate any human error that could screw everything.
(that, of course, if the automation process is done correctly)
Create a certificate system requires a lot of responsibility. If certificates of more than 90 days are unsafe, should not exist in any other case, if wildcard certificates are unsafe should not exist at all.
There is not a security problem, is a problem of responsibility. They want to do something that requires a lot of responsibility not assume at all.
I presume you in a way shared an opinion with this extremely vocal “90 days certs are bad” minority. And basically said that Google engineers are out of their minds… And if you (and by you I mean everyone in the aforementioned minority group) don’t like LE practices, you are very much welcome to use services of any other CA in the field. Freedom of choice, right? I though it’s very much clear at this point, that longer certificates from LE are a no go, and these complaints are not helping anyone, they’re just adding to the universe’s entropy.
This discussion is the most active thread in this forum and the “minority” (as some “fanboys” call those who are against this policy) is the one that has voiced the real-world concerns of the 90-days limit. I have yet to a see a compelling argument on why the limit is in place, other than, “Google does it, so we must as well”, or “it’s good for you, trust us”. This is the most ridiculous argument which demonstrates the lack of real-world applications this project will have. Unless of-course Let’s encrypt is aimed at Google-sized businesses, which makes perfect sense. Anyway as an IIS server admin, who is snubbed in the n-th degree by this whole project, I’m dissapointed by the lack of understanding on why people need a choice on the certificate validity length. The single minded “automation” only, no manual process is also both annoying and dangerous. I just wish Let’s encrypt had informed us fully on their schemes before getting our hopes up. Anyway, I wish all the best to any poor soul wishing to commit to this project…
It's probably worth noting that Google wrote a majority of their software - they're doing it because they can ensure it works. That doesn't apply to most of us.
I, and most of the dissenters, do not think 90 day cert lifetimes are necessarily bad. But our issue is with only issuing 90 day lifetime certs when there is clearly issues that make them impractical for many environments and applications.
If there where some significant technical limitation that prevented or made issuing 1 year lifetime certificates impractical that would be different. But the Let’s Encrypt policy is being based on misguided control freak and behavioral driving philosophy. Beginning to feel like a government program. Might fit in well, philosophically, in China and NK.
Well, nobody banned or censored you... I suppose that's not very North Korean.
I don't see any point in discussing this more, there is clear reasons why the working group as decided to set the 90 days lifetime on the certificate, and I can see you disagree but I can only observe that nothing is new enough to
That's a poor excuse for bad practice in my opinion. Component of a system can fail, and that just a fact of life, but human intervention are error prone and should be avoided whenever possible.
I don't see the issue here, your grandmother server must have cronjob... just as any other server must have?
