Respect. But Sven's doing 50 sites, not 3. At 15 min per that's 12.5 hours of clicking. My 3am Docker trauma scales better than that.
Also Sectigo resellers vary wildly. Some send you a zip file and make you concatenate chains manually like it's 2011.
Member
For local clients in VN I use BuyPass too. One problem: their ACME server from Southeast Asia is slow. Not failed, just slow. 30-45 seconds for finalization sometimes. Cert-manager retries but it adds jitter to my logs.
I asked their support, they said "no datacenter in region." So if your clients measure latency obsessively, note this.
This is what I mean about trust anchors. You are depending on BuyPass infrastructure, their BGP, their DDoS mitigation. At least with step-ca the latency is YOUR problem, not some support ticket.
But I still say don't run your own CA for external clients. The risk calculus is wrong.
Has anyone tried Google Trust Services? Free through their public CA program, 90 day certs, ACME endpoint. I used it for a personal project last year but didn't stress test the limits. I checked it against https://www.ssllabs.com/ssltest/ at the time and it looked fine.
Downside: you need a Google Cloud account even for the free tier. Another vendor to bill.
Looked at this. The free tier requires registering in Google Cloud Certificate Manager, and there's a quota of 100 certificates per project per lifetime for the free issuance. Not weekly — lifetime. Blow through that on one migration and you're paying Google rates.
So that's out for bulk.
Current leaderboard for my specific hell:
Someone tell me Vultr supports wildcards before I give them money.
