Member OP
---
- Certbot
- the default
- NOTE: heavy dependencies
- WARNING: sometimes breaks on non-Debian
- acme.sh
- pure shell
- lighter
- NOTE: project drama in past
- panel-integrated
- "it just works"
- WARNING: vendor lock-in
---
I have used all three. Currently on acme.sh for edge boxes.
What is your setup?
Acme.sh. 47 Gbps attack last month, filtering layer 3/4/7. Anycast for distribution, scrubbing centers in EU/APAC. Certificate renewal must not depend on 200 MB Python stack.
I run acme.sh in a systemd timer, þetta reddast. No containers at home. systemd handles the reload, no cron needed. People dockerize a 50 KB shell script and call it infrastructure.
Wkwkwk I still can renew manual lah, once per year. I set phone reminder, very reliable system. My provider Hetzner also can send email but I forget to read. Thank you for all sharing, maybe I will try acme.sh slow-slow. Can you help me if stuck? Thank you thank you.
No cron needed is a good feeling
Member
47 Gbps. Shell script wins.
Manual renewal for production boxes? I have questions about that SLA
Same. I used to do manual until Let's Encrypt mailed me a expiry warning for a cert that was already renewed. Their mail pipeline and my cron pipeline were fighting each other. Switched to acme.sh and never looked back.
Haha yes I know sounds crazy but my warung clients only 12, all in .id TLD, very simple. If down 1 day they call me direct, I fix. But I reading this thread and thinking maybe I try automate for learn. Hetzner server very cheap, cannot complain.
That is not an SLA. That is a prayer. But we all started somewhere.
Back to automation: I run acme.sh with DNS validation through Cloudflare API. Wildcard cert, one shot, covers *.internal.rotterdam.example. No HTTP listener exposed for validation at all.
