Support for Academic Institutions

[mpst-peachey]

I work for one of those famous institutions (like Cambridge / Oxford for example). As you know there are several departments and colleges and individual IT support units in each of those. So there are two questions. Can Cambridge/Oxford universities use Lets Encrypt en-masse which will almost certainly be over the 50 cert a week limit. The second question is if we request a pro-active increase and then we need to request another one - can anybody working in IT at oxford do that or does it need to be a designated person. If that person left the university, could someone else easily replace them (ie we want to make sure one email address isn't linked to future requests so we don't end up not being able to use LE). I hope that makes sense and for what it's worth I LOVE LE you've saved my life -- for the moment

[Patryk]

@mpst-peachey

I work for one of those famous institutions (like Cambridge / Oxford for example). As you know there are several departments and colleges and individual IT support units in each of those. So there are two questions. Can Cambridge/Oxford universities use Lets Encrypt en-masse which will almost certainly be over the 50 cert a week limit.

Yes, you can request a rate limit increase either for registered domain (https://publicsuffix.org/ is used as reference), or for ACME account. Since each department will likely want to use their own separate ACME accounts, requesting a registered domain rate limit increase is the way to go.

Rate Limits

Also note, that renewals will be exempt from the 50 certs/week limitation, if implemented correctly, so there should always be possible to renew existing certs even if the 50 certs/week limit is hit.

@mpst-peachey

The second question is if we request a pro-active increase and then we need to request another one - can anybody working in IT at oxford do that or does it need to be a designated person. If that person left the university, could someone else easily replace them (ie we want to make sure one email address isn't linked to future requests so we don't end up not being able to use LE).

You could set up an email alias, e.g. letsencrypt-contact@example.edu and route it to person/group who is currently responsible for cert management.

@mpst-peachey

I hope that makes sense and for what it's worth I LOVE LE you've saved my life -- for the moment

We love it too, that's why a bunch of volunteers are here to help out spreading democrac^Z, khem... security.

[petercooperjr]

@mpst-peachey

Can Cambridge/Oxford universities use Lets Encrypt en-masse which will almost certainly be over the 50 cert a week limit

Just to be clear, you're expecting more than 50 new domain names added per week, regularly? Once a name gets its first certificate, as long as it gets renewed before expiration then it doesn't count toward that limit anymore.

@mpst-peachey

The second question is if we request a pro-active increase and then we need to request another one - can anybody working in IT at oxford do that or does it need to be a designated person.

I don't think it needs to be a designated person, though I'm not sure how they authenticate that the person who submits the rate increase form is authorized to make requests for that domain.

[mpst-peachey]

I am blown away by all the responses here - this has helped massively clarify the situation and I appreciate the replies from everyone bringing absolute clarity to this question. All the best from Oxford