king_tronzington comments on TLS Certificate Lifetimes Will Officially Reduce to 47 Days

Technology

88,700 readers

14,593 active

3,280 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related news or articles.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago

moderators

[–] king_tronzington@lemm.ee 4 points 2 years ago (4 children)

I've proposed using Let's Encrypt but my coworkers believe there would be a perception issue with us using a "free" TLS certificate provider. I work for a popular internet search engine so it's a reasonable worry.

It just seems like LE has the most efficient automatic renewal setup, though I haven't looked in detail at other providers.

permalink

fedilink

source

parent

hideshow 4 child comments

[–] patatahooligan@lemmy.world 12 points 2 years ago (2 children)

That sound weird to me. How big is the population of people who are technical enough to even check what certificate provider you are using but ignorant enough to think that let's encrypt is bad because it's free?

permalink

fedilink

source

parent

hideshow 2 child comments

[–] Glitchvid@lemmy.world 5 points 2 years ago

There can be theoretical audit or blame issues , since you're not "paying" then how does the company pass the buck (SLA contracts) if something fucks up with LE.

permalink

fedilink

source

parent

[–] bane_killgrind@slrpnk.net 1 point 2 years ago

Managers.

permalink

fedilink

source

parent

[–] corsicanguppy@lemmy.ca 3 points 2 years ago

LetsEncrypt also built ACME, so they're the primary port for testing RFC8555. They're just gonna work better at it.

But, as above, maybe Digi is still the way for you, with the right tooling glued in.

Good luck!

permalink

fedilink

source

parent