I’ve been downloading SSL certificates from my domain provider, using cat to join them together to make the fullchain.pem, uploading them to the server, and myself adding a 90 day calendar reminder. Every time I did this I’d think I should find out about this Certbot thing.

Well, I finally got around to it, and it was one of those jobs which turns out to be so easy you wish you’d done it ages ago.

The install was simple (I’m using nginx/ubuntu).

It scans up your server conf files to see which sites are being served, asks you a couple of questions, obtains the Let’s Encrypt certificate for them, installs it, updates your conf files to use it, and sets up a cron job to check if it’s time to renew the certificate, which it will also do auto-magically.

I was so pleased with it I made a donation to the EFF for it, then I started to think about how amazingly useful Let’s Encrypt is, and gave them one too. It’s just a really good time to be in this hobby.

I highly recommend Certbot. If you’ve been putting this off, or only just hearing about it, make some time for it.

  • SheeEttin@lemmy.worldEnglish
    162·
    1 year ago

    Wait until you stand up your own CA and issue certs with multi-year validity so they don’t have to be renewed more often than you rebuild everything anyway

    At least until you try to access stuff on a Pixel phone which doesn’t let you install CA certs any more 😞

    • dauerstaender@feddit.deEnglish
      16·
      1 year ago

      Having certificates that are valid for over a year is contra-productive, as when they get in to the wrong hands they might still be valid for a year until they naturally run out of time. The reason LetsEncrypt issues only 90d valid certificates is not to annoy you, but save your ass once someone obtains your certificates.

      • FrederikNJS@lemm.eeEnglish
        5·
        1 year ago

        While shorter lived certs certainly improve the general security, certificate revocation lists are what you need if a cert gets compromised.

        • dauerstaender@feddit.deEnglish
          7·
          1 year ago

          They don’t work in practice, no modern browser actively queries any revocation DBs. It’s just much more efficient to let something expire sooner than keep track of all lost somethings.

      • dan@upvote.auEnglish
        1·
        1 year ago

        Exactly this. The CA/B forum (who make rules about TLS certificates that all the providers follow) are actively trying to reduce certificate validity periods. 2-3 years ago, they reduced the maximum duration for TLS certificates to 13 months. It’s likely they’ll go even lower in the future.

        My understanding is that they want the entire industry to move towards a Let’s Encrypt style system where renewal is fully automated and thus there’s minimal overhead to renewing more frequently. We’re not quite there yet.

    • FrederikNJS@lemm.eeEnglish
      5·
      1 year ago

      Wait until you set up cert-manager to issue both Let’s Encrypt certificates, as well as generating your own CA and issuing certs from your own CA where you can set the validity however want.

    • StefanT@lemmy.worldEnglish
      2·
      1 year ago

      I had no problem to install my CA on my Pixel (Android 13). I read that this was not possible for some time but Google changed it.

    • dan@upvote.auEnglish
      1·
      1 year ago

      That’s a lot of work just to avoid a renewal process that’s fully automated. Seems counter productive.

    • SpaceCadet@sopuli.xyzEnglish
      1·
      1 year ago

      Pixel phone which doesn’t let you install CA certs any more

      Is that something new? I can still install CA certs on my Pixel 6. It does give a scary warning, but you can just click through it.