Skip to content
Register

What do you use for SSL certificates nowadays?

General Discussion by adam20 27 replies 2K views
larryjeong

Member

#11

I run certbot on a $3.50 KnownHost reseller box in Dallas. The systemd timer failed silently for six months because I moved /etc/letsencrypt to a symlink on a second disk. certbot renewed fine, nginx could not read the symlink after reboot. Found out when a customer called me about the expired cert on their WooCommerce site.

Now I have a Nagios check for expiry within 14 days. Automation is great until it isn't.

Still cheaper than $89.

$3/year. 128MB RAM. Pure happiness.
haroldgsm

Member

Grumpy Old Sysadmin

#12
larryjeong said:
Now I have a Nagios check

This is what I mean. You built a Nagios check because free came with homework. Your time has value. The $89 includes someone else's Nagios check.

Also KnownHost is in Dallas, Atlanta and Amsterdam, not Los Angeles, so your latency to west coast customers is what, 40ms? You saved on the cert and spent it on RTT.

IPv4, IRC, and irssi — fight me
larryjeong

Member

#13

My customers are in Texas. The Dallas DC is why I picked them. And I built the Nagios check in 2012 for paid certs too, because providers forget just as often as cron does.

$3/year. 128MB RAM. Pure happiness.
Petra3

Member

latency witch

#14
haroldgsm said:
Let's Encrypt won't indemnify you

No CA with publicly trusted roots indemnifies end users against downtime. Read the subscriber agreement for DigiCert, Sectigo, or any commercial CA. The warranty covers mis-issuance, not your revenue.

Your "paper trail" is a fantasy. The SLA covers their signing service, not your OCSP lookup.

haroldgsm

Member

Grumpy Old Sysadmin

#15

I have read them. The difference is enforceability. A contract with a US entity gives you discovery. A nonprofit in California with no phone number gives you a forum post and a prayer.

IPv4, IRC, and irssi — fight me
annexbi

Member

#16
haroldgsm said:
Discovery

You are going to sue a CA over a 90-day cert? In which court? For what damages? Your "consulting" rate?

I have been in Oslo traffic court for a parking fine. That took eight months. Good luck with your discovery.

push. done. coffee.
Viejito

Member

retired & rooted

#17

In Spain I use dns challenge with acme.sh because my IP is dynamic, no? Very easy with Cloudflare API, no problem. Before very difficult with paid cert, need send fax for change IP, no? Very crazy.

But I understand for bank, for hospital, need support phone. Different world.

marcus_qc

Member

#18

My WordPress people would not know what a cert is if it bit them. I use CloudCone for cheap VPS, $2/month for testing, but I would not buy certs from them. Their billing is in USD which is fine for me in Montreal.

I set up acme.sh for my resold customers with DNS challenge through Cloudflare (https://www.cloudflare.com). Most of them already use Cloudflare for "speed." I tell them it is for the cert, they nod, I do the work.

42U and still growing
adam20

Member OP

Ex-Abuse Desk

#19
Manish24 said:
CloudCone still charges $89 for a broken chain?

They "escalated to senior provisioning" and sent the intermediate within four hours. Which is fine, except this is the third time in two years. The first time they blamed "a change in the CA's bundle format." The second time they said my "CSR was malformed" which it was not.

I am not angry, I am tired. The $89 is not the problem. The problem is I am paying for tedium.

Going to try acme.sh on one subdomain this week. If it works I will migrate the other two.

reported. resolved. repeat.
Marek

Member

Traceroute Detective

#20

In Poland I use lego with OVH DNS. Very good for wildcard. The binary is one file, no Python, no shell script, no cron fighting. I run it from systemd timer with OnFailure alert to Telegram.

I tried certbot first but the snap package on Ubuntu was 200MB and wanted to manage my nginx config. No thank you. I manage my own configs.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft